Zero Trust practice questions

A branch office has users, finance workstations, printers, and IP phones on one flat LAN. After a malware outbreak on a user PC, management wants to limit lateral movement without blocking printing or voice traffic. What should the network team implement?

Trap 1: Move all devices into one larger subnet and rely on endpoint…

This removes any network-level containment and depends too heavily on endpoint detection after compromise occurs.

Trap 2: Place all devices behind a single proxy server and block all…

A proxy does not solve internal segmentation for printers and phones, and blocking all east-west traffic would break normal operations.

Trap 3: Enable port security on the switch and disable all VLAN tagging to…

Port security may help with some access control, but it does not provide the needed policy separation across device types.

A
Move all devices into one larger subnet and rely on endpoint antivirus for separation.
Why wrong: This removes any network-level containment and depends too heavily on endpoint detection after compromise occurs.
B
Create separate VLANs for device groups and apply inter-VLAN ACLs that permit only required traffic.
This limits reachability between device classes while still allowing necessary business traffic such as printing and VoIP signaling.
C
Place all devices behind a single proxy server and block all internal east-west traffic.
Why wrong: A proxy does not solve internal segmentation for printers and phones, and blocking all east-west traffic would break normal operations.
D
Enable port security on the switch and disable all VLAN tagging to reduce complexity.
Why wrong: Port security may help with some access control, but it does not provide the needed policy separation across device types.

Read the full VPN explanation →

Question 2mediummultiple choice

A company's current remote access solution uses a traditional VPN that grants users full network-layer access to the internal LAN once authenticated. The security architect wants to adopt a zero trust architecture to reduce the risk of lateral movement by compromised endpoints. Which of the following implementations best aligns with zero trust principles?

Trap 1: Implement a next-generation firewall and require all remote traffic…

A next-generation firewall provides deep packet inspection and policy enforcement, but still operates at the network layer. Remote users who authenticate are granted network-level access, which does not align with the zero trust principle of granting access only to specific applications on a per-session basis.

Trap 2: Deploy a secure web gateway and require all remote users to browse…

A secure web gateway (SWG) primarily secures web traffic and can enforce URL filtering and malware inspection. It does not replace the need for application-specific access control and still allows broad network access after authentication, which is contrary to zero trust's micro-segmentation requirement.

Trap 3: Enable multi-factor authentication for VPN and implement a VPN…

Multi-factor authentication strengthens the authentication step, but once the MFA challenge is passed, the VPN still grants full network-layer access to the LAN. Split tunneling can even expose the internal network to additional risks. This does not satisfy the zero trust requirement of granular, per-resource access control.

A
Implement a next-generation firewall and require all remote traffic to pass through it with strict rules.
Why wrong: A next-generation firewall provides deep packet inspection and policy enforcement, but still operates at the network layer. Remote users who authenticate are granted network-level access, which does not align with the zero trust principle of granting access only to specific applications on a per-session basis.
B
Deploy a secure web gateway and require all remote users to browse through a proxy.
Why wrong: A secure web gateway (SWG) primarily secures web traffic and can enforce URL filtering and malware inspection. It does not replace the need for application-specific access control and still allows broad network access after authentication, which is contrary to zero trust's micro-segmentation requirement.
C
Use a software-defined perimeter that authenticates each user and device before granting access only to specific applications.
A software-defined perimeter (SDP) or zero trust network access (ZTNA) solution authenticates and authorizes each connection request individually, creating an encrypted tunnel only to the requested application. This prevents lateral movement because the user never receives a network-level address on the internal LAN.
D
Enable multi-factor authentication for VPN and implement a VPN concentrator with split tunneling.
Why wrong: Multi-factor authentication strengthens the authentication step, but once the MFA challenge is passed, the VPN still grants full network-layer access to the LAN. Split tunneling can even expose the internal network to additional risks. This does not satisfy the zero trust requirement of granular, per-resource access control.

Question 3mediummultiple choice

A cloud support team is changing the way employees access an internal finance portal. Instead of trusting the user's initial login for the rest of the session, the portal now checks identity, device posture, and request context again before allowing access to payroll data or download actions. Which security concept is being implemented?

Trap 1: Defense in depth

Layered controls may be present, but the key idea here is continuous verification rather than simply adding more barriers.

Trap 2: Need-to-know

Need-to-know limits access to specific information, but this scenario is about how access decisions are continuously validated.

Trap 3: Least privilege

Least privilege reduces the amount of access granted, but it does not by itself describe repeated verification of each request.

A
Defense in depth
Why wrong: Layered controls may be present, but the key idea here is continuous verification rather than simply adding more barriers.
B
Zero trust
Zero trust assumes that no user, device, or network path should be trusted by default, even after initial authentication. Each access request is evaluated using identity, device health, and context before the action is allowed. That approach fits the scenario because sensitive actions are rechecked instead of relying on a one-time login event.
C
Need-to-know
Why wrong: Need-to-know limits access to specific information, but this scenario is about how access decisions are continuously validated.
D
Least privilege
Why wrong: Least privilege reduces the amount of access granted, but it does not by itself describe repeated verification of each request.

Question 4hardmultiple choice

A web portal for customer refunds checks device health at sign-in, then re-checks the device and user context before each refund over a threshold. A session that started on a managed laptop is blocked when the laptop later fails posture checks, even though the password remains valid. Which principle is best illustrated?

Trap 1: Defense in depth

Defense in depth uses multiple layers, but the distinguishing feature here is continuous trust evaluation rather than just stacked controls.

Trap 2: Least privilege

Least privilege would limit permissions to only what the user needs, but it does not specifically describe repeated trust checks during a session.

Trap 3: Need-to-know

Need-to-know is about limiting access to information that is necessary for a task, not about re-evaluating session trust.

A
Defense in depth
Why wrong: Defense in depth uses multiple layers, but the distinguishing feature here is continuous trust evaluation rather than just stacked controls.
B
Zero trust
The portal does not trust the session simply because the user authenticated once. It repeatedly evaluates device posture and context before granting sensitive actions, and it can deny access when risk changes. That is the core of zero trust: verify explicitly, assume no persistent trust, and re-evaluate access continuously instead of relying on an initial login event.
C
Least privilege
Why wrong: Least privilege would limit permissions to only what the user needs, but it does not specifically describe repeated trust checks during a session.
D
Need-to-know
Why wrong: Need-to-know is about limiting access to information that is necessary for a task, not about re-evaluating session trust.

Question 5hardmultiple choice

Based on the exhibit, which security principle should the team strengthen to reduce the chance that stolen credentials alone provide access to sensitive data?

Exhibit

VPN and application audit
08:04 user rpatel authenticated from home laptop
08:05 VPN tunnel established
08:06 request: GET /finance/q4-forecast.xlsx
08:06 policy: allowed because prior login within 12 hours
08:07 note: device posture not checked; no step-up MFA

Trap 1: Least privilege, because the user should only have the minimum file…

Least privilege is important, but the exhibit shows the bigger issue is trust being granted after one successful login. The user is not receiving excessive file permissions inside the application; instead, the access decision is too permissive over time and location.

Trap 2: Need-to-know, because all finance data should be hidden from anyone…

Need-to-know limits information to what a person requires for their role, but the exhibit is focused on stale trust decisions after authentication. The problem is not only who can know the data; it is that the session remains trusted without rechecking the user or device.

Trap 3: Defense in depth, because multiple layers are always better than…

Defense in depth is a valuable design idea, but this exhibit highlights a trust model problem rather than missing layers. The environment already has a VPN and application controls; the weakness is that one login is being treated as sufficient for continued access.

A
Least privilege, because the user should only have the minimum file permissions needed.
Why wrong: Least privilege is important, but the exhibit shows the bigger issue is trust being granted after one successful login. The user is not receiving excessive file permissions inside the application; instead, the access decision is too permissive over time and location.
B
Zero trust, because every request should be re-evaluated instead of relying on the earlier VPN login.
Zero trust fits the exhibit because access is being allowed based on an earlier authentication event and network location alone. A zero-trust design would re-evaluate each request using factors such as device health, identity, and context instead of assuming the session is safe for 12 hours.
C
Need-to-know, because all finance data should be hidden from anyone outside the department.
Why wrong: Need-to-know limits information to what a person requires for their role, but the exhibit is focused on stale trust decisions after authentication. The problem is not only who can know the data; it is that the session remains trusted without rechecking the user or device.
D
Defense in depth, because multiple layers are always better than one control.
Why wrong: Defense in depth is a valuable design idea, but this exhibit highlights a trust model problem rather than missing layers. The environment already has a VPN and application controls; the weakness is that one login is being treated as sufficient for continued access.

Question 6hardmultiple choice

Based on the exhibit, which security principle is the proposed access model most aligned with?

Exhibit

Current access model:
- Any laptop on the corporate VPN can reach 10.8.40.15:443.
- The VPN checks device compliance only when the tunnel is created.
- After login, the session remains valid for 12 hours.
- Users can access the finance app from any managed or unmanaged device once connected.

Security proposal:
- Reevaluate device posture before each sensitive transaction.
- Grant only application-specific access, not subnet-wide access.
- Require MFA again if device risk changes during the session.

Trap 1: Least privilege, because users are being limited to only the…

Least privilege is part of the proposal, but it does not fully capture the repeated trust checks and dynamic access decisions. The exhibit emphasizes that device posture, session risk, and authentication state are continuously reconsidered. That behavior goes beyond simple permission reduction and reflects an architecture that assumes no implicit trust from network location or initial login.

Trap 2: Defense in depth, because the company is adding multiple security…

Defense in depth does involve multiple layers, and this design certainly uses them. However, the central idea in the exhibit is not just layering controls; it is refusing to trust the session simply because it started on a managed network. The repeated validation and per-request access decisions are what make zero trust the better fit.

Trap 3: Need-to-know, because users should only see the finance data…

Need-to-know limits information exposure, but the proposal is focused on when and how access is granted, especially after device risk changes. The issue is not just data visibility; it is the assumption of trust after VPN login. Continuous revalidation of identity and device state is a zero trust concept, not merely a need-to-know rule.

A
Least privilege, because users are being limited to only the finance application they need.
Why wrong: Least privilege is part of the proposal, but it does not fully capture the repeated trust checks and dynamic access decisions. The exhibit emphasizes that device posture, session risk, and authentication state are continuously reconsidered. That behavior goes beyond simple permission reduction and reflects an architecture that assumes no implicit trust from network location or initial login.
B
Zero trust, because access is continuously evaluated instead of trusted just because the device is on the VPN.
Zero trust is the best answer because the proposal removes implicit trust based on VPN membership or internal network location. Instead, access is evaluated repeatedly using device posture, MFA, and transaction context. That means the environment assumes every request may be risky until verified, which is the core idea behind zero trust architecture and conditional access.
C
Defense in depth, because the company is adding multiple security layers around the finance app.
Why wrong: Defense in depth does involve multiple layers, and this design certainly uses them. However, the central idea in the exhibit is not just layering controls; it is refusing to trust the session simply because it started on a managed network. The repeated validation and per-request access decisions are what make zero trust the better fit.
D
Need-to-know, because users should only see the finance data required for their jobs.
Why wrong: Need-to-know limits information exposure, but the proposal is focused on when and how access is granted, especially after device risk changes. The issue is not just data visibility; it is the assumption of trust after VPN login. Continuous revalidation of identity and device state is a zero trust concept, not merely a need-to-know rule.

Open the full VLAN trunking answer →

Question 7hardmultiple choice

A company runs payroll and HR application servers on the same VLAN because a redesign is not possible this quarter. Security wants to reduce lateral movement if one workload is compromised, but the team cannot renumber the environment or add new physical firewalls. Which control best fits the requirement?

Trap 1: Move the servers into a single larger subnet so internal routing is…

This would make segmentation weaker, not stronger. Combining systems into a larger subnet usually expands broadcast scope and makes it easier for an attacker to move laterally once inside.

Trap 2: Place the servers behind a network address translation device to…

NAT can hide addressing details, but it does not provide meaningful internal segmentation or limit east-west access between the workloads. An attacker who compromises one host may still reach the other if no filtering exists.

Trap 3: Rely on password rotation and MFA for administrative logins only

Authentication hardening helps protect accounts, but it does not isolate compromised workloads from each other. The question is about limiting lateral movement inside the environment, which requires traffic enforcement between systems.

A
Move the servers into a single larger subnet so internal routing is simplified
Why wrong: This would make segmentation weaker, not stronger. Combining systems into a larger subnet usually expands broadcast scope and makes it easier for an attacker to move laterally once inside.
B
Implement microsegmentation with host-based or distributed firewall rules between workloads
Microsegmentation is the best fit when the organization cannot redesign the network but still needs to isolate workloads more tightly. Host-based or distributed firewall rules can restrict east-west traffic between individual servers, even when they share the same VLAN. That reduces lateral movement far better than coarse VLAN-only separation and does not require renumbering the environment.
C
Place the servers behind a network address translation device to hide their IP addresses
Why wrong: NAT can hide addressing details, but it does not provide meaningful internal segmentation or limit east-west access between the workloads. An attacker who compromises one host may still reach the other if no filtering exists.
D
Rely on password rotation and MFA for administrative logins only
Why wrong: Authentication hardening helps protect accounts, but it does not isolate compromised workloads from each other. The question is about limiting lateral movement inside the environment, which requires traffic enforcement between systems.