1.3 Explain the Concept of Zero Trust and Define Its Key Principles CYBERSECURITY-PRACTITIONER Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A company is redesigning its access control policy to align with Zero Trust. The finance team currently has access to the entire ERP system, but only three employees need to process payroll. What change best reflects the principle of least privilege?

   • AMove the ERP system to a private cloud to reduce exposure.
   • BRestrict payroll processing access to only the three employees who need it.
   • CKeep the current access for all finance team members to avoid workflow disruptions.
   • DGrant access to the entire finance team but require manager approval for each transaction.
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A security architect is designing a new application. The architect wants to apply the principle of breach assumption. Which design decision best reflects this principle?

   • AUse encryption for all data in transit and at rest.
   • BImplement strong authentication for all users.
   • CAssume that an attacker is already inside the network and design the application to limit the damage they can cause.
   • DFocus on preventing all external attacks from entering the network.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium

   A company is implementing Zero Trust. The security team is debating whether to trust users who are connected via the corporate VPN. The CISO insists that the VPN should not grant automatic trust. Which approach best aligns with the CISO's directive?

   • ATreat VPN users the same as any other user and require continuous verification of identity and device posture.
   • BAllow VPN users to access all resources but log their activity for auditing.
   • CGrant VPN users full access to internal resources because they have authenticated.
   • DRequire VPN users to use a strong password and change it monthly.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   An organization has implemented a Zero Trust architecture. A user's device was recently compromised, but the security team detected the anomaly and revoked access before any data was exfiltrated. Which Zero Trust principle is most directly responsible for this outcome?

   • ANetwork segmentation
   • BBreach assumption
   • CContinuous monitoring and validation of user and device behavior
   • DLeast privilege access enforcement
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A company is moving to a Zero Trust model. The security team is deciding how to handle access requests from employees working from home. Which approach best aligns with Zero Trust?

   • AVerify the user's identity and device posture for every access request, regardless of location.
   • BAllow remote employees to access all resources but log their activity.
   • CRequire remote employees to use a strong password and change it monthly.
   • DTrust remote employees because they have authenticated via the VPN.
   Reveal Solution Discussion Select an answer first