Covers zero trust fundamentals, tenets and pillars, applying zero trust across networks, data, identity, cloud, and hybrid environments, and visibility, automation, and monitoring.
12 free sample questions150 in the full practice test
Introduction to Zero Trust · From perimeter security to Zero Trust
When designing a Zero Trust architecture based on NIST SP 800-207, which component is explicitly responsible for computing the access decision based on enterprise policy and input from external sources?
Answer and explanation
Correct answer: D
According to NIST SP 800-207, the Policy Engine (PE) is the core component that computes whether a subject is granted access to a resource. It analyzes enterprise policy alongside inputs from external sources like threat intelligence and CDM. The Policy Administrator (PA) executes this decision by communicating with the Policy Enforcement Point (PEP), which physically or logically blocks or allows the traffic.
Question 2
Advanced
Introduction to Zero Trust · Explaining Zero Trust and its drivers
A multinational financial services firm is transitioning from a traditional perimeter-based security model to a Zero Trust architecture. They currently rely heavily on VPNs for remote access and stateful firewalls for internal segmentation. The Chief Information Security Officer (CISO) needs to present a business case to the board that justifies the transition.
Which of the following arguments provides the most compelling business case for moving away from their current de-perimeterization state toward a mature Zero Trust model?
Answer and explanation
Correct answer: A
The primary business driver for Zero Trust in modern enterprises is the failure of traditional perimeter security (like VPNs) to contain breaches. Once an attacker breaches the perimeter, they have implicit trust to move laterally. Zero Trust's 'assume breach' tenet addresses this by enforcing least privilege and continuous verification at the identity and data levels, directly mitigating the financial and reputational damage of lateral movement.
graph TD
subgraph Traditional Perimeter
VPN[VPN Gateway] -->|Implicit Trust| Internal[Internal Network]
Attacker1[Attacker] -.->|Compromised Creds| VPN
Internal -->|Lateral Movement| Data1[(Sensitive Data)]
end
subgraph Zero Trust Architecture
Auth[Identity & Context Engine] -->|Explicit Trust| PEP[Policy Enforcement Point]
Attacker2[Attacker] -.->|Compromised Creds| Auth
Auth -.->|Access Denied| PEP
PEP -->|Micro-segmented| Data2[(Sensitive Data)]
end
Question 3
Beginner
Introduction to Zero Trust · From perimeter security to Zero Trust
True or False: De-perimeterization in the context of Zero Trust means that an organization must completely dismantle its existing perimeter firewalls before beginning its Zero Trust journey.
Answer and explanation
Correct answer: B
False. De-perimeterization refers to the concept that the traditional network perimeter is no longer the sole boundary for security due to cloud adoption, remote work, and mobile devices. It does not mean dismantling existing firewalls. Zero Trust is an additive strategy that uses existing perimeter defenses as part of a defense-in-depth approach while pushing enforcement closer to the assets.
Question 4
Intermediate
Zero Trust Tenets and Pillars · Zero Trust in Dell Cyber Recovery and Vault
When mapping Zero Trust pillars to the Dell PowerProtect Cyber Recovery solution, which capability directly addresses the 'Data' pillar by ensuring that backups cannot be altered or deleted by a compromised administrator account?
Answer and explanation
Correct answer: D
Retention Lock Compliance enforces strict immutability, ensuring that data cannot be modified, deleted, or overwritten for a specified period, even by users with full administrative privileges. This directly maps to the Data pillar of Zero Trust by providing data-centric protection against insider threats and ransomware.
Question 5
IntermediateMultiple answers
Zero Trust Tenets and Pillars · Tenets and pillars
According to the CISA Zero Trust Maturity Model, which of the following are recognized as foundational pillars of a Zero Trust Architecture? (Select THREE)
Answer and explanation
Correct answers: B, D, E
Data is one of the five foundational pillars in the CISA Zero Trust Maturity Model, focusing on data protection, classification, and encryption.
Identity is one of the five foundational pillars in the CISA Zero Trust Maturity Model.
Network is one of the five foundational pillars in the CISA Zero Trust Maturity Model, focusing on segmentation and traffic inspection.
Question 6
Beginner
Zero Trust Tenets and Pillars · Tenets and pillars
A security architect is explaining the difference between the foundational rules of Zero Trust and the categorical areas where it is applied. Which of the following statements correctly distinguishes a 'tenet' from a 'pillar' in Zero Trust architecture?
Answer and explanation
Correct answer: D
In Zero Trust frameworks, tenets are the foundational principles or philosophies that guide the security strategy (such as 'assume breach', 'verify explicitly', and 'least privilege'). Pillars are the specific functional domains or control surfaces (such as Identity, Device, Network, Application/Workload, and Data) where those tenets are operationalized.
Register free for 6 more questions
Or unlock all 150 D-ZT-DS-23 questions with explanations, timed mode and flashcards.
