NetSec-Architect Zero Trust Architecture And Design Practice Test 5 — 15 Questions

Question 1

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Azure Firewall Premium deployed in the hub virtual network, with spoke virtual networks peered to the hub and user-defined routes pointing to the firewall private IP.. Zero Trust design requires that traffic between application tiers be explicitly inspected rather than implicitly trusted because it stays inside the cloud environment. A hub virtual network with Azure Firewall Premium and forced routing through user-defined routes ensures that inter-spoke flows are evaluated against Layer 7 policy, including IDPS and TLS inspection, while spokes remain isolated from one another by default.

Answer

Network security groups attached to each workload subnet, with application security groups used to group the tiers.

Answer

Azure Private Link endpoints in each spoke virtual network, with private DNS zones resolving the application FQDNs.

Answer

Azure DDoS Protection Standard applied to each spoke virtual network, with service endpoints for all application subnets.

Question 2

A retail company is adopting a Zero Trust architecture and wants to eliminate implicit trust based on network location. The security architect is asked to define the guiding principle that should drive access decisions for every user and device. Which principle should the architect apply?

Accepted Answer

Verify explicitly on every access request using identity, device, and context signals before granting least-privilege access.. Zero Trust replaces location-based trust with continuous, explicit verification of identity, device health, and context, followed by least-privilege authorization. Options that trust a medium, a segment, or a completed login all preserve some form of implicit trust. Only verifying every request and limiting access to what is needed satisfies the architecture's core principle.

Answer

Grant broad access after a successful login and rely on periodic quarterly access reviews to remove excess rights.

Answer

Segment the network into many VLANs and trust traffic that stays within each segment boundary.

Answer

Trust all endpoints that reside on the corporate wired VLAN and challenge only wireless clients.

Question 3

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A centralized policy engine that evaluates access requests based on identity and context.. In a multi-cloud Zero Trust architecture, a centralized policy engine and federated identity providers are essential. The policy engine evaluates access requests using identity and context, while IdPs provide the verified identity assertions. Together, they enable consistent, dynamic access control across all cloud environments, ensuring that only authorized users and devices can access resources, regardless of location.

Answer

A SIEM solution to collect and correlate logs from all cloud environments.

Answer

A VPN concentrator in each cloud region to route all traffic through a central hub.

Answer

A next-generation firewall in each cloud to inspect all traffic.

Question 4

A healthcare provider is designing a Zero Trust architecture for its electronic health record (EHR) environment. The EHR application is hosted on-premises and accessed by clinicians from managed laptops and by patients from unmanaged mobile devices. The architect must ensure that only managed, compliant devices can access the EHR directly, while patient access is brokered through a reverse proxy that performs authentication and application-layer inspection. The solution must minimize the attack surface and enforce device posture. Which combination of Palo Alto Networks components best meets these requirements?

Accepted Answer

GlobalProtect with HIP checks for clinicians and a web proxy with SSL decryption for patients. The correct answer pairs GlobalProtect with HIP checks for managed clinician laptops and a reverse proxy with SSL decryption for unmanaged patient devices. HIP checks verify device compliance before granting direct EHR access, while the proxy authenticates patients and inspects application-layer traffic. This design enforces posture where possible and brokers access where agents cannot be installed, reducing attack surface.

Answer

GlobalProtect with HIP checks for all users and a firewall policy that allows any application from the patient zone

Answer

A next-generation firewall with App-ID and User-ID for all traffic, without any proxy or VPN

Answer

IPsec VPN with static pre-shared keys for all users and a firewall zone for patients

Question 5

A security architect is redesigning a campus network to follow Zero Trust principles. The current design places all access switches in a single Layer 2 VLAN with the core, allowing any authenticated user to reach any internal resource. The architect wants to enforce policy based on user identity and device posture while minimizing changes to the existing switching infrastructure. Which approach best aligns with Zero Trust network segmentation?

Accepted Answer

Implement 802.1X with dynamic VLAN assignment and downloadable ACLs from the RADIUS server based on user group and posture.. The correct approach uses the existing 802.1X-capable access layer to enforce identity- and posture-based segmentation. By pushing dynamic VLAN and ACL assignments from RADIUS, the architecture achieves least-privilege access without a disruptive redesign. The other options either fail to enforce identity-aware policy, do not address posture, or require significant infrastructure changes that the scenario seeks to avoid.

Answer

Create a single large subnet with private VLANs (PVLANs) to isolate hosts at Layer 2 while keeping the same VLAN interface.

Answer

Deploy a next-generation firewall between every access switch and the core, forcing all inter-VLAN traffic through inspection.

Answer

Enable DHCP snooping and dynamic ARP inspection on all access switches to prevent lateral movement.

Question 6

A network security architect is explaining Zero Trust concepts to a non-technical audience. The architect needs to describe the core principle that differentiates Zero Trust from traditional perimeter-based security. Which statement best captures this principle?

Accepted Answer

Trust is never granted implicitly; it must be continuously verified for every access request.. The core principle of Zero Trust is that no entity is trusted by default, and trust must be continuously verified for every access request. This means that even users and devices inside the corporate network must be authenticated and authorized, and their trust level is reassessed based on context. This principle fundamentally changes how security is designed, moving from perimeter defense to identity-centric protection.

Answer

Users must authenticate with multi-factor authentication (MFA) only when accessing from outside the office.

Answer

All traffic must be encrypted using IPSec VPNs to ensure confidentiality.

Answer

The network perimeter must be strengthened with multiple firewalls to prevent breaches.

Question 7

A multinational retailer is implementing a Zero Trust architecture across its 200 stores and two data centers. Each store has a Palo Alto Networks firewall managed by Panorama, and the data centers use PA-5400 Series firewalls. The security team wants to enforce least-privilege access for store-to-data-center traffic and ensure that only required applications are allowed, regardless of port. The architect must also prevent store-to-store communication. Which two design elements should the architect include in the Zero Trust policy design? (Choose two.)

Accepted Answer

Application-based security policies using App-ID to allow only required applications between store and data center zones. The correct answer includes application-based policies with App-ID to allow only required applications, and a default deny plus a specific deny for store-to-store traffic. App-ID enforces least privilege by identifying applications independent of port, while the deny rules prevent lateral movement between stores. Together, they satisfy the requirement to allow only required applications and block store-to-store communication.

Answer

Static route redistribution between all store firewalls to enable direct store-to-store communication

Answer

Port-based security policies that allow all traffic on ports 80 and 443 between store and data center zones

Answer

A single any-any allow rule between all zones to simplify policy management

Question 8

An architect is designing a Zero Trust architecture for a hybrid cloud environment. On-premises workloads must access SaaS applications and public cloud services, and the organization wants to enforce consistent security policy regardless of user location. The architect proposes using a cloud access security broker (CASB) in inline mode with forward proxy and API-based scanning. Which design consideration is most critical to maintain Zero Trust enforcement when users are remote?

Accepted Answer

Ensure that all remote user traffic is tunneled to the CASB using a device agent or explicit proxy, and that the CASB can apply tenant restrictions and data loss prevention policies.. Consistent Zero Trust enforcement for remote users requires that all traffic traverse the inline CASB, typically via a device agent or explicit proxy. This ensures tenant restrictions, DLP, and access policies apply uniformly. API-only or split-tunnel designs create enforcement gaps, and ISP-level DNS filtering is not under the organization's control and is easily bypassed.

Answer

Configure the CASB in API mode only, relying on the SaaS provider's logs to detect policy violations after the fact.

Answer

Use DNS-based filtering at the remote user's ISP to block unsanctioned SaaS applications.

Answer

Deploy the CASB only for on-premises users and use split tunneling for remote users to reduce latency.

Question 9

A software company is adopting a Zero Trust model for its cloud workloads. The security architect must ensure that only authorized users and devices can access a web application hosted in AWS. The application is behind a Palo Alto Networks VM-Series firewall. The architect wants to verify user identity and device posture before granting access, and must also inspect the traffic for threats. Which solution should the architect implement?

Accepted Answer

GlobalProtect with HIP checks and App-ID security policies on the VM-Series firewall. The correct answer uses GlobalProtect with HIP checks to verify user identity and device posture, and App-ID on the VM-Series firewall to inspect traffic for threats. This provides identity-aware, posture-based access control and threat inspection for the cloud web application. It aligns with Zero Trust principles by not trusting network location alone and enforcing least privilege.

Answer

An AWS security group that permits HTTPS from any source and a WAF in front of the application

Answer

A site-to-site VPN between the corporate network and AWS with static routing

Answer

A network ACL that allows only the corporate IP range to reach the web application

Question 10

A network security architect is implementing a Zero Trust architecture and wants to ensure that only authorized devices can connect to the corporate network. The organization has a mix of managed and unmanaged devices. Which component is essential to verify device identity and health before granting access?

Accepted Answer

A public key infrastructure (PKI) with certificate-based authentication and a device posture assessment service.. Device identity and health verification require strong authentication and posture assessment. PKI with certificate-based authentication ensures only authorized devices possess valid credentials, while posture assessment checks compliance with security policies. Together they provide the real-time trust evaluation needed before granting access, which firewalls, SIEMs, or VPN concentrators alone cannot deliver.

Answer

A VPN concentrator that terminates all remote connections.

Answer

A SIEM system that correlates logs from multiple sources.

Answer

A next-generation firewall with intrusion prevention system (IPS) signatures.

Question 11

A government agency is implementing a Zero Trust architecture for its data center. The agency has a Palo Alto Networks PA-5400 Series firewall at the perimeter and internal segmentation firewalls between server tiers. The security team wants to enforce least privilege for east-west traffic between the web, application, and database tiers. The architect must ensure that if the web tier is compromised, the attacker cannot move laterally to the database tier. Which design approach best achieves this?

Accepted Answer

Deploy internal segmentation firewalls with strict App-ID and User-ID policies that allow only required application flows between tiers, with a default deny. The correct answer uses internal segmentation firewalls with App-ID and User-ID policies and a default deny. This enforces least privilege by permitting only required application flows between tiers and blocking all other traffic. If the web tier is compromised, the attacker cannot move laterally to the database tier because unauthorized traffic is denied at the segmentation firewall.

Answer

Use VLANs to separate tiers and rely on router ACLs to control traffic between VLANs

Answer

Place all tiers behind the perimeter firewall and use a single security zone with different IP subnets

Answer

Implement a flat network with host-based firewalls on each server to control traffic

Question 12

A healthcare provider is implementing a Zero Trust network access solution for remote clinicians using Google Cloud. Clinicians must access internal web applications hosted on Compute Engine instances without exposing those instances to the public internet. The architect plans to use Identity-Aware Proxy (IAP) for TCP forwarding. Which two components are required to allow IAP TCP forwarding to reach the instances? (Choose two.)

Accepted Answer

Firewall rules that allow ingress traffic from the IAP TCP forwarding IP range 35.235.240.0/20 to the target instances on the required ports.. IAP TCP forwarding requires both an identity-side control and a network-side control. The IAM role roles/iap.tunnelResourceAccessor authorizes a user to create a tunnel, enforcing Zero Trust authentication and authorization. The firewall rule allowing ingress from 35.235.240.0/20 permits IAP's infrastructure to reach the instance on the application port. Together they allow access without exposing the instance to the internet.

Answer

A load balancer with a backend service that includes the Compute Engine instances as backends.

Answer

An external IP address assigned to each Compute Engine instance so IAP can reach them.

Answer

A Cloud NAT gateway configured in the instance's subnet to allow outbound connections to the IAP service.

Question 13

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Legacy applications may not support the SDN overlay's encapsulation, requiring the use of a gateway or proxy to translate traffic.. Legacy applications often cannot run host-based agents or support overlay encapsulations, making it difficult to enforce micro-segmentation directly on them. A gateway or proxy is typically required to translate traffic between the overlay and legacy networks, which can introduce policy enforcement gaps and performance bottlenecks. This integration challenge is more fundamental than static addressing, broadcast support, or latency concerns.

Answer

Micro-segmentation increases east-west latency, which legacy applications cannot tolerate.

Answer

The SDN controller cannot enforce policies on legacy applications because they use static IP addresses.

Answer

Legacy applications require broadcast traffic, which is not supported in SDN overlays.

Question 14

A retail company is adopting a Zero Trust architecture and wants to replace traditional VPN access for its remote employees. The security architect must ensure that users are authenticated with multi-factor authentication and that access decisions consider device posture before a session is established. Which Google Cloud service should the architect use for this requirement?

Accepted Answer

Identity-Aware Proxy (IAP) with context-aware access levels that evaluate user identity, MFA, and device posture.. Identity-Aware Proxy with context-aware access levels is the Google Cloud service designed to enforce Zero Trust access for users. It authenticates the user, verifies MFA, and evaluates device posture through access levels before allowing access to applications or VMs. This replaces traditional VPN by making access decisions per session based on identity and context rather than network location.

Answer

Cloud VPN with strongSwan on each user's laptop and IKEv2 certificate authentication.

Answer

VPC Service Controls with an access policy that restricts API calls to trusted networks.

Answer

Cloud Interconnect with a dedicated attachment and Cloud Router for private connectivity.

Question 15

A security architect is designing a Zero Trust inspection architecture for a data center migrating workloads to Microsoft Azure. East-west traffic between application tiers must be inspected with Layer 7 security policy, but the workloads must remain in their own Azure virtual networks and route through a central hub. Which Azure-native design element should the architect place in the hub virtual network to achieve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

A policy engine that evaluates access requests against organizational policies and threat intelligence.. Continuous verification in Zero Trust relies on a policy engine that evaluates context and a policy administrator that enforces decisions by managing connections. These two components form the control plane that dynamically grants, limits, or revokes access. Other elements like firewalls, SIEMs, and VPNs can support the architecture but are not essential for the core continuous verification function.

Answer

A next-generation firewall with integrated intrusion prevention system (IPS).

Answer

A security information and event management (SIEM) system for log aggregation.

Answer

A virtual private network (VPN) concentrator for remote access.