1.5 Implement Continuous Monitoring and Analytics of Zero Trust Environment NETWORK-SECURITY-ARCHITECT Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What is a key role of analytics in real-time threat detection within a zero trust environment?

   • AAutomatically patching all vulnerable systems
   • BReplacing the need for security policies
   • CIdentifying anomalies that may indicate a security threat
   • DEnsuring all users have multi-factor authentication enabled
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does continuous monitoring contribute to continuous improvement of security policies in a zero trust environment?

   • ABy eliminating the need for policy reviews
   • BBy automatically rewriting all policies based on user feedback
   • CBy ensuring policies remain unchanged to maintain stability
   • DBy providing data that reveals gaps or weaknesses in current policies
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A government agency is implementing a zero trust architecture and wants to ensure that its continuous monitoring program provides real-time visibility into user access requests, device health, and network traffic. The agency also needs to correlate these signals to enforce access decisions dynamically. Which approach best supports this requirement?

   • AImplement a vulnerability management program that scans endpoints weekly
   • BRely on periodic manual reviews of access logs
   • CDeploy a SIEM that ingests logs from identity, device, and network sources and use its correlation rules to trigger policy enforcement
   • DUse a standalone network monitoring tool that only analyzes NetFlow data
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A security team has been monitoring a zero trust environment for several months. They have noticed that a particular access policy is frequently triggered by legitimate users who work remotely and use a VPN. The team wants to reduce the number of false positives while ensuring that the policy still detects genuine anomalies. Which action is most aligned with continuous improvement?

   • AIncrease the alert threshold for all users to reduce noise
   • BAdjust the risk score for the policy based on the context of the VPN usage
   • CModify the policy to exclude the VPN's IP addresses from the anomaly detection logic
   • DDisable the policy and rely on other monitoring controls
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A university is implementing continuous monitoring for its zero trust environment. The security team needs to monitor network traffic for malicious activity, such as command-and-control communication, but does not want to deploy agents on every endpoint. Which technology is best suited for this requirement?

   • AVulnerability management scanner
   • BEndpoint detection and response (EDR) platform
   • CHost-based intrusion detection system (HIDS)
   • DNetwork detection and response (NDR) tool
   Reveal Solution Discussion Select an answer first