2.1 Describe Key Characteristics of Zero Trust Network Access (ZTNA) CYBERSECURITY-PRACTITIONER Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   How does ZTNA differ from a traditional VPN in terms of access control?

   • AZTNA requires users to be on the corporate network, while VPN allows access from anywhere.
   • BZTNA provides access to the entire network, while VPN provides access only to specific applications.
   • CBoth ZTNA and VPN provide the same level of granular access control.
   • DZTNA grants access to specific applications based on identity, while VPN typically grants broad network access once connected.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security analyst is comparing the visibility provided by a traditional VPN and a ZTNA solution. They want to be able to see exactly which applications each user is accessing and for how long. Which statement accurately describes the difference in visibility?

   • AZTNA provides less visibility because it encrypts all traffic, making it impossible to inspect.
   • BZTNA provides detailed logs of application-level activity, while a VPN typically only shows that a user is connected to the network.
   • CA VPN provides more detailed visibility because it can see all network traffic, while ZTNA only sees application traffic.
   • DBoth provide the same level of visibility, as they both log all user activity.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company is implementing ZTNA and has a critical application that is used by both internal employees and external contractors. The internal employees are on managed devices, while the contractors are on unmanaged personal devices. The security team wants to enforce stricter access for contractors. Which ZTNA access model and policy combination is most appropriate?

   • AUse a VPN for contractors, as ZTNA cannot support unmanaged devices.
   • BUse an identity-based model for employees and an application-based model for contractors, but do not configure any device posture checks.
   • CUse an identity-based model for all users, and grant contractors access to the same set of applications as employees.
   • DUse an application-based model for all users, and configure a policy that requires device posture checks for contractors, denying access if the device is not compliant.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company is implementing a ZTNA solution. They have set up the broker, the policy engine, and integrated with their identity provider. They are now testing the solution. A user attempts to access an application, but the request is denied. The user's identity is verified, and their device is compliant. What is the most likely reason for the denial?

   • AThe policy engine has a rule that denies access to this specific application for this user's role, even though the user is authenticated.
   • BThe broker is not configured correctly and is blocking all traffic.
   • CThe identity provider is not sending the correct user attributes to the policy engine.
   • DThe user is accessing the application from an untrusted network, which is always blocked by ZTNA.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company is considering a move from a traditional VPN to ZTNA. The network team is concerned about the operational impact. Which of the following is a key operational benefit of ZTNA that would help address their concerns?

   • AZTNA requires more hardware to be deployed on-premises, increasing the operational burden.
   • BZTNA requires users to learn a new, complex client software that is harder to manage than a VPN client.
   • CZTNA increases the attack surface by exposing applications to the internet.
   • DZTNA can simplify network architecture by removing the need for complex firewall rules and network segmentation to control application access.
   Reveal Solution Discussion Select an answer first