1.4 Explain the Application of Network Hardening Methods for Enhanced Security on Strata and SASE Products (e.g., Content-ID, Zero Trust, User-ID, Device-ID, Zones) NETWORK-SECURITY-PROFESSIONAL Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security architect is designing a Zero Trust network for a company that has both on-premises data center and cloud applications. They want to enforce least-privilege access, but also need to maintain high availability for critical applications. Which approach best aligns with Zero Trust principles while addressing availability?

   • AGrant broad access to trusted users and rely on network segmentation to contain breaches
   • BDeploy a next-generation firewall at the perimeter and allow all traffic from authenticated users
   • CImplement identity-based micro-segmentation with continuous verification, and design redundant paths for critical services
   • DUse a VPN for all remote access and trust internal traffic once inside the perimeter
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A university uses Prisma Access for students and faculty. They want to enforce a policy that allows faculty to access research databases, but blocks students from accessing them. They also want to ensure that if a user's identity cannot be determined, access is denied by default. Which approach best meets these requirements?

   • AUse User-ID to map users to groups, and create a rule that allows faculty and denies all other users, with a default deny rule
   • BUse Content-ID to inspect the database traffic and allow only research content
   • CUse Zones to separate faculty and student networks, and allow traffic from the faculty zone
   • DUse Device-ID to identify devices, and allow only faculty-owned devices
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   What is the core principle of the Zero Trust model as implemented in Strata and SASE products?

   • ATrust internal users but verify external users
   • BTrust the network but verify applications
   • CNever trust, always verify — regardless of the network location or source
   • DTrust devices but verify users
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the primary role of security zones in hardening network traffic in Strata and SASE products?

   • ATo encrypt all traffic within the zone
   • BTo inspect the content of traffic within the zone
   • CTo segment the network and control traffic flow between different areas
   • DTo identify users and groups within the zone
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which Content-ID capability is used to prevent sensitive data from leaving the network?

   • AUser-ID
   • BData Filtering
   • CDevice-ID
   • DZone Protection
   Reveal Solution Discussion Select an answer first