Zero Trust Architecture: CC Practice Questions

Question 1

Which of the following best describes the concept of implicit trust as it relates to a Zero Trust model?

Access permissions limited strictly to the least privilege required Trust assigned to entities based on continuous posture assessment signals Automatic confidence given to entities based on their network location Confidence granted to entities after each access request is verified

Correct Answer: Automatic confidence given to entities based on their network location

Implicit trust refers to automatic confidence given to entities simply because they reside within a trusted network location, such as an internal corporate network. Zero Trust exists specifically to eliminate this assumption, treating every request as untrusted regardless of origin.

The option about verifying each access request describes explicit trust, the opposite of implicit trust. Continuous posture assessment reflects dynamic, ongoing verification, not automatic confidence. Least privilege is an access control principle limiting permissions, not a description of trust origin.

Key concept tested: understanding implicit trust as location-based assumed confidence that Zero Trust seeks to remove.

Question 2

In Zero Trust Architecture, which statement best characterizes the granularity at which trust is established?

Trust is granted to authenticated users across all connected resources Trust is granted for an entire network zone once a user is verified Trust is granted on a per-session, per-resource basis for each request Trust is granted per device after it passes an initial posture check

Correct Answer: Trust is granted on a per-session, per-resource basis for each request

Zero Trust operates on the principle of never trust, always verify, granting access on a per-session, per-resource basis where every request is evaluated individually based on identity, device posture, and context.

Granting trust for an entire network zone contradicts Zero Trust by relying on implicit trust within a perimeter. Granting trust per device after a single posture check ignores continuous verification and treats one check as permanent. Granting trust across all connected resources creates broad access that violates least privilege and micro-segmentation principles.

Key concept: dynamic, least-privilege access enforced per request rather than through implicit network trust.

Question 3

An organization builds a Zero Trust deployment but wants a way to measure whether its trust decisions are staying effective over time. Leadership asks the security team to select a metric that would flag when access-granting behavior is drifting toward risky patterns. Which choice would serve this goal best?

A key risk indicator tracking the rate of access grants tied to weak posture signals A shared security model chart tracking provider and customer responsibility splits A defense-in-depth report tracking how many layered controls guard each resource A least-privilege audit tracking whether each role holds only its needed permissions

Correct Answer: A key risk indicator tracking the rate of access grants tied to weak posture signals

A key risk indicator that tracks how often access is granted despite weak posture signals directly measures whether trust decisions are drifting toward risky patterns over time, which is exactly what leadership wants to flag.

The shared security model chart addresses cloud provider versus customer responsibility, not trust drift. The defense-in-depth report counts layered controls but says nothing about access-granting behavior trends. The least-privilege audit checks role permissions at a point in time rather than measuring drift in dynamic trust decisions.

Key concept: using key risk indicators to monitor the effectiveness of Zero Trust access decisions over time.

Zero Trust Architecture

CC - Zero Trust Architecture Example Questions

Question 1

Question 2

Question 3

Begin Your Cybersecurity Career

Other Domain 4: Networking and Cloud Security Concepts concepts