Brainscape's Knowledge GenomeTM


Top Flashcards (Certified)
All Flashcards

CCZT > Introduction to ZTA - Implementation options of ZTA > Flashcards

Introduction to ZTA - Implementation options of ZTA Flashcards

1
Q

What does ZTA stand for?

A

Zero Trust Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q

Which document defines the various ZTA implementation approaches?

A

NIST SP 800-207

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

What are the two main ZTA implementation approaches defined by NIST?

A
  • ZTA Using Micro-Segmentation
  • ZTA Using Network Infrastructure and Software-Defined Perimeters
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

What is one of the primary ZTA implementation options covered in this unit?

A

CSA’s SDP

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q

Name another primary ZTA implementation option.

A

Zero Trust Network Access (ZTNA)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q

What is the third primary ZTA implementation option mentioned?

A

Google BeyondCorp

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

True or False: The unit focuses on ZTA implementation options outside of network architecture.

A

False

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q

Fill in the blank: The options presented in this unit align with NIST approaches including ZTA Using _______.

A

Micro-Segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

Fill in the blank: The options presented in this unit align with NIST approaches including ZTA Using Network Infrastructure and _______.

A

Software-Defined Perimeters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q

What does NIST stand for?

A

National Institute of Standards and Technology

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

What is the primary focus of the NIST ZT model?

A

Designing secure workflows

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

How many approaches does NIST provide for ZT implementation?

A

Three approaches

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

Name one of the three NIST ZTA approaches.

A

ZTA using Enhanced Identity Governance

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q

Name another NIST ZTA approach.

A

ZTA using Micro-Segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Name the last NIST ZTA approach.

A

ZTA using Network Infrastructure and Software Defined Perimeters

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

What factors influence the selection of a NIST ZT approach?

A

Existing business flows, requirements, and cybersecurity maturity level

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q

True or False: A fully-realized ZT solution incorporates elements from all three NIST ZTA approaches.

A

True

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

Fill in the blank: The unit focuses on NIST approaches for ‘ZTA Using _______’ and ‘ZTA Using Network Infrastructure and Software-Defined Perimeters’.

A

Micro-Segmentation

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

What does ZTA stand for?

A

Zero Trust Architecture

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
20
Q

What does NIST SP 800-207 outline?

A

ZT tenets

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
21
Q

What is the significance of policy rules in NIST ZT approaches?

A

They vary according to the components used and the organization’s environment

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
22
Q

Subsequent ZT training courses provide what?

A

A more comprehensive and expanded overview of NIST’s approach to ZT

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
23
Q

What is the Software-Defined Perimeter (SDP)?

A

An approach to enabling and enforcing Zero Trust principles by providing dynamically provisioned air-gapped networks.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
24
Q

What does Zero Trust (ZT) require in terms of access verification?

A

Verification of anything and everything attempting to access assets prior to authorization.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
25
Q

How does SDP improve security posture?

A

By defending against new variations of old attack methods and adapting to expanding attack surfaces.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
26
Q

What is the default policy enforced by the SDP gateway?

A

Drop-all policy until users/devices are authenticated and authorized.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
27
Q

List the major components of SDP architecture.

A
  • Client/initiating host (IH)
  • Service/accepting host (AH)
  • SDP controller
  • SDP gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
28
Q

What is the role of the SDP controller?

A

Secures access to isolated services by ensuring authentication, authorization, device validation, and secure communications.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
29
Q

What types of devices can act as the initiating host (IH)?

A

Laptops, tablets, and smartphones.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
30
Q

True or False: The AH devices typically reside on a network under the enterprise’s control.

A

True.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
31
Q

What are the four key responsibilities of the SDP controller?

A
  • Users are authenticated and authorized
  • Devices are validated
  • Secure communications are established
  • User and management traffic remain separate
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
32
Q

What deployment options are available for implementing SDP?

A
  • Client-to-Gateway
  • Client-to-Server
  • Server-to-Server
  • Client-to-Server-to-Client
  • Client-to-Gateway-to-Client
  • Gateway-to-Gateway
How well did you know this?
1
Not at all
2
3
4
5
Perfectly
33
Q

What principle ensures that users can only access resources they are explicitly granted permissions to?

A

Principle of least privilege.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
34
Q

What must be verified before the IH can connect to the AH?

A

The IH and users must be authenticated and authorized by the controller.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
35
Q

Fill in the blank: SDP controllers should be designed for high _______ to withstand attacks.

A

availability

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
36
Q

What should be considered when deploying gateways in an SDP?

A

They can block a service in the event of failure or overload.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
37
Q

How can SDP controllers inform access policies?

A

Through internal user-to-service mapping or connections to third-party services.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
38
Q

What is a common use case for deploying Zero Trust Architecture (ZTA) with multiple cloud providers?

A

Managing a local network while using two or more cloud service providers for hosting applications/services and data.

39
Q

What is a prominent use case of ZTA?

A

Cross-enterprise collaboration

40
Q

In a cross-enterprise collaboration, which enterprises are involved in the hypothetical project example?

A

Enterprise A and Enterprise B

41
Q

Who manages the project database in the collaboration between Enterprise A and Enterprise B?

A

Enterprise A

42
Q

What is required for Enterprise B employees in the context of accessing data from Enterprise A?

A

Specialized accounts

43
Q

What must be denied to all other resources for Enterprise B employees accessing data from Enterprise A?

44
Q

What can complicate the management of access permissions between Enterprise A and Enterprise B?

A

The approach of setting up specialized accounts

45
Q

What system can streamline the configuration of permissions for cross-enterprise collaboration?

A

Federated ID management system

46
Q

What is necessary for both organizations’ PEPs in a federated ID community?

A

Authenticate subjects

47
Q

What are the main advantages of SDP?

A

Maturity and widespread adoption

SDP has been supported by prominent enterprises and institutions such as the DOD.

48
Q

What types of deployments is SDP used for?

A

Hybrid and multi-cloud deployments, VPN replacement, securing IoT

SDP is implemented across various industries for differing purposes.

49
Q

What ongoing events contribute to SDP’s popularity?

A

Regular hackathons testing SDP’s attack durability

These events help validate the security of SDP.

50
Q

What mechanisms are effective for enforcing ZT principles in SDP?

A

SPA and mTLS

These mechanisms enhance security without compromising user experience.

51
Q

How does SDP improve user experience?

A

Provides robust security while replacing legacy solutions

SDP can enhance the overall experience for users.

52
Q

Is SDP easy to implement?

A

Yes, it is relatively easy to implement and can complement existing solutions

Organizations can adopt a gradual implementation or migration to SDP.

53
Q

What kind of environments can SDP protect?

A

Highly complex deployments, such as hybrid and multi-cloud environments

SDP’s distributed and scalable nature aids in protecting these environments.

54
Q

What is a built-in feature of SDP’s architecture?

A

High availability

This feature ensures that services remain accessible.

55
Q

What is a major disadvantage of SDP?

A

Requirement for client agent installation on each endpoint

This can complicate deployment for organizations.

56
Q

What access methods are primarily supported by SDP?

A

Traditional user access methods

API-based, micro-service, and serverless access methods are not well-supported.

57
Q

What does ZTNA stand for?

A

Zero Trust Network Access

58
Q

Which three models have influenced ZTNA?

A

CSA’s SDP, Google’s BeyondCorp, and ZTNA itself

59
Q

What is the primary premise of ZTNA?

A

Neither users nor applications are behind the perimeter

60
Q

What are the two distinct architectures of ZTNA?

A
  • Endpoint-initiated ZTNA
  • Service-initiated ZTNA
61
Q

What is a key feature of endpoint-initiated ZTNA?

A

A lightweight agent is installed on the end-user’s device

62
Q

What is a disadvantage of endpoint-initiated ZTNA?

A

Difficult to implement on unmanaged devices

63
Q

How does service-initiated ZTNA function?

A

Uses a broker between the user and the application

64
Q

What is the role of the lightweight ZTNA connector in service-initiated ZTNA?

A

Establishes an outbound connection from the service to the ZTNA service broker

65
Q

What does ZTNA assume about the user access environment?

A

It assumes a hostile user access environment

66
Q

What principle does ZTNA operate under regarding user access?

A

Never trust, always verify

67
Q

What is a major advantage of using ZTNA?

A

Reduces the attack surface by hiding services behind brokers

68
Q

In what mode can ZTNA be implemented?

A
  • Stand-alone product
  • As a service
69
Q

What are some advantages of cloud-based ZTNA?

A
  • Scalability
  • Ease of adoption
70
Q

What is a significant disadvantage of ZTNA in terms of malicious actors?

A

Cannot guard against malicious actors already inside the perimeter

71
Q

What technology provides continuous inspection beyond initial connection authorization?

A

Secure access service edge (SASE)

72
Q

What is a challenge related to policy management in ZTNA?

A

Orders of magnitude more complex for programmatic access

73
Q

Fill in the blank: ZTNA is often considered a _______ replacement.

74
Q

True or False: ZTNA can guard against all types of malicious actors.

75
Q

What is BeyondCorp?

A

Google’s internal network and access security platform designed to enable employee access to internal resources

BeyondCorp Enterprise is available to organizations with Google-based IT infrastructures.

76
Q

What is the primary component of BeyondCorp?

A

The web proxy

It acts as the chokepoint every user/device needs to traverse to access the organization’s resources.

77
Q

List notable features of BeyondCorp.

A
  • Any access to protected resources is done via proxy
  • Device and user identities are checked using a device inventory and user/group database
  • 802.1x protocol is used for verifying managed devices and providing micro-segmentation
  • An access control engine authorizes the organization’s applications and services
  • A data pipeline feeds additional information into the access control engine

Additional information includes location, device/user trust levels, etc.

78
Q

How does BeyondCorp comply with Zero Trust (ZT) principles?

A
  • Device/user must be authenticated and authorized by the access proxy before connecting to enterprise applications
  • The access proxy denies any access request from unauthenticated users or devices
  • Each access request is handled separately by the access proxy, following the principle of least privilege
  • The access proxy is continuously monitored, logging all network communications

This includes both legitimate and illegitimate access attempts.

79
Q

Fill in the blank: The access proxy in BeyondCorp is the _______ of all access attempts and communication.

A

[choke point]

80
Q

True or False: BeyondCorp allows access requests from unauthenticated users.

81
Q

What protocol is used in BeyondCorp to verify managed devices?

82
Q

What does the access control engine in BeyondCorp do?

A

Provides authorization for the organization’s applications and services

83
Q

Fill in the blank: BeyondCorp uses a _______ to check device and user identities.

A

[device inventory and user/group database]

84
Q

What is the purpose of the data pipeline in BeyondCorp?

A

To feed additional information into the access control engine

85
Q

What is BeyondCorp?

A

Google’s proprietary implementation of Zero Trust Architecture (ZTA)

BeyondCorp focuses on providing secure access to applications without relying on traditional perimeter security.

86
Q

What are the limited implementation options for BeyondCorp?

A

Some organizations implement a simplified version using an access proxy only

This means additional components like device inventory and trust engine are left out.

87
Q

What is the Service Initiated (Remote Application Access) approach in BeyondCorp?

A

A connector is deployed on the same network as shared applications to establish an outbound session

Users/devices authenticate with the provider to access protected applications.

88
Q

How does the authentication workflow function in BeyondCorp’s implementation?

A

Users are forced through an authentication workflow before access is granted

This prevents direct access to applications until the authentication process is complete.

89
Q

What is the significance of the agentless model in BeyondCorp?

A

Agent software is not required on the connecting device

Application access occurs over HTTP/HTTPS at layer 7 of the OSI model.

90
Q

What are the advantages of BeyondCorp?

A

Does not require client agent installation on devices, devices must be registered in the inventory

Each device is assigned a unique certificate.

91
Q

What are the disadvantages of BeyondCorp?

A

Less flexible, difficult to integrate with existing security mechanisms, lack of strong cryptographic controls

Compared to SDP, BeyondCorp’s access proxy is less scalable and secure.

92
Q

True or False: BeyondCorp requires client agent installation on connecting devices.

A

False

BeyondCorp does not require client agent installation, but devices should be registered.

93
Q

Fill in the blank: BeyondCorp’s lack of strong cryptographic controls makes it less secure than _______.

A

SDP

Strong cryptographic controls are necessary for implementing an invisible cloud.

94
Q

What role does the access proxy play in BeyondCorp?

A

It handles both control and data traffic

This makes it less scalable and secure compared to the SDP controller.

CCZT (13 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2025 Bold Learning Solutions. Terms and Conditions