ACL Zero Trust Architecture & Microsegmentation 3

Question 1

In Zero Trust Architecture, what is the role of the Policy Enforcement Point (PEP)?

Accepted Answer

It intercepts access requests and enforces decisions made by the Policy Decision Point

Answer

It creates and stores access control policies for the organization

Answer

It authenticates users using multi-factor authentication methods

Answer

It monitors network traffic and generates alerts for security events

Question 2

What is 'identity-based segmentation' in a Zero Trust microsegmentation approach?

Accepted Answer

Applying access controls based on verified user and workload identity rather than IP address

Answer

Segmenting the network based on the physical location of workstations

Answer

Using VLAN tags to assign users to network segments by department

Answer

Segmenting networks based on device operating system type

Question 3

Which of the following best describes 'workload segmentation' in a microsegmented data center?

Accepted Answer

Enforcing traffic policies at the individual application or container level

Answer

Dividing physical servers into separate racks for different departments

Answer

Assigning each workload to a separate physical network interface card

Answer

Isolating workloads using separate hypervisor hosts for each application

Question 4

How does multi-factor authentication (MFA) support Zero Trust Architecture?

Accepted Answer

MFA provides stronger identity verification, reducing risk even when credentials are stolen

Answer

MFA replaces the need for encryption in Zero Trust environments

Answer

MFA is only required for administrative accounts in a Zero Trust model

Answer

MFA satisfies all Zero Trust requirements without additional controls

Question 5

What is the significance of 'device health verification' in Zero Trust Architecture?

Accepted Answer

It validates that connecting devices meet security posture requirements before granting access

Answer

It ensures devices have sufficient storage capacity for security logs

Answer

It confirms that devices are registered in the corporate asset inventory only

Answer

It checks that devices are running approved productivity software

Question 6

In a Zero Trust model, how should ACL rules be structured for microsegmented environments?

Accepted Answer

Use a default-deny model with explicit allow rules for approved traffic flows

Answer

Use a default-allow model with explicit deny rules for known threats

Answer

Allow all traffic between workloads in the same microsegment by default

Answer

Permit traffic based on IP subnet membership without additional verification

Question 7

Which metric best measures the effectiveness of microsegmentation in reducing breach impact?

Accepted Answer

Reduction in lateral movement scope and blast radius of a simulated attack

Answer

Total number of firewall rules deployed across the network

Answer

Percentage of network traffic that is encrypted end-to-end

Answer

Number of unique user identities managed in the identity provider