ACL Zero Trust Architecture & Microsegmentation 2

Question 1

What is the function of a Policy Decision Point (PDP) in Zero Trust Architecture?

Accepted Answer

It evaluates access requests against policies and grants or denies access

Answer

It encrypts data in transit between network segments

Answer

It monitors network traffic for anomalous behavior patterns

Answer

It manages digital certificates for device authentication

Question 2

How does microsegmentation differ from traditional VLAN-based network segmentation?

Accepted Answer

Microsegmentation provides workload-level granularity, while VLANs segment at the subnet level

Answer

Microsegmentation operates at Layer 7, while VLANs operate at Layer 2

Answer

Microsegmentation is only applicable to cloud environments, while VLANs work on-premises only

Answer

Microsegmentation requires physical hardware changes, while VLANs are purely software-defined

Question 3

In Zero Trust Architecture, what is 'East-West' traffic?

Accepted Answer

Traffic moving laterally between servers and services within a data center or cloud

Answer

Traffic flowing between the data center and remote branch offices

Answer

Traffic from external users accessing internal web applications

Answer

Traffic between geographically distributed data centers over WAN links

Question 4

Which NIST publication provides the primary framework for implementing Zero Trust Architecture?

Accepted Answer

NIST SP 800-207

Answer

NIST SP 800-53

Answer

NIST SP 800-171

Answer

NIST SP 800-61

Question 5

What is a Software-Defined Perimeter (SDP) in the context of Zero Trust?

Accepted Answer

A dynamic, identity-centric access control model that hides infrastructure from unauthorized users

Answer

A physical firewall appliance that enforces network boundaries

Answer

A cloud-based VPN solution for remote workforce connectivity

Answer

A SIEM tool that correlates security events across network segments

Question 6

What is a primary challenge when adopting Zero Trust Architecture in legacy enterprise environments?

Accepted Answer

Legacy systems often lack the APIs and identity integration needed for continuous verification

Answer

Zero Trust requires replacing all existing network hardware immediately

Answer

Zero Trust is incompatible with cloud-based identity providers

Answer

Zero Trust mandates the elimination of all existing firewall rules

Question 7

Which of the following is a key component of the Zero Trust 'Five Pillars' model developed by the U.S. Department of Defense (DoD)?

Accepted Answer

Identity, Devices, Networks, Applications & Workloads, and Data

Answer

Perimeter Security, Encryption, Logging, Patching, and Backup

Answer

Firewall, IDS, VPN, SIEM, and Endpoint Protection

Answer

Authentication, Authorization, Accounting, Auditing, and Availability