1.5 Implement Continuous Monitoring and Analytics of Zero Trust Environment NETWORK-SECURITY-ARCHITECT Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a zero trust architecture, continuous monitoring primarily contributes to which security objective?

   • AMaintaining an up-to-date understanding of the environment's security state
   • BGuaranteeing that no security incidents will occur
   • CEliminating the need for user authentication
   • DEnsuring all users have the same level of access
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A financial institution has been running continuous monitoring for six months. The security team has noticed that a particular access policy is generating a high number of alerts for legitimate user activity, causing alert fatigue. The team wants to improve the policy's accuracy without reducing security coverage. What is the most effective approach?

   • AIncrease the alert severity to make the alerts more noticeable
   • BUse the monitoring data to adjust the policy's risk thresholds and exceptions
   • CIgnore the alerts and focus on other security metrics
   • DDisable the policy to eliminate the alerts
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A retail company's security team has been monitoring user behavior and noticed that a specific group of users consistently triggers false positives for impossible travel alerts because they use a VPN that routes traffic through a central hub. The team wants to reduce alert fatigue while maintaining effective monitoring. What is the most appropriate action?

   • AIgnore the alerts and focus on other monitoring data
   • BCreate an exception policy for the VPN hub's IP addresses and adjust the risk scoring
   • CDisable the impossible travel detection rule entirely
   • DIncrease the alert threshold for all users to reduce noise
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary purpose of alerts generated by monitoring analytics in a zero trust environment?

   • ATo provide a summary of all network traffic for compliance reporting
   • BTo notify security personnel of potential security incidents that require attention
   • CTo automatically delete all user accounts involved in suspicious activity
   • DTo replace the need for security incident response plans
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A multinational corporation has implemented a zero trust architecture and wants to ensure that monitoring data from its cloud and on-premises environments is correlated to provide a unified view of security events. The security team also wants to automate responses, such as blocking a user's access when a threat is detected. Which approach best supports this requirement?

   • ADeploy separate monitoring tools for cloud and on-premises and manually correlate alerts
   • BImplement a data lake and use manual analysis for all security events
   • CRely on each environment's native monitoring and alerting capabilities
   • DUse a SIEM platform that ingests data from both environments and integrates with orchestration tools for automated response
   Reveal Solution Discussion Select an answer first