Free D-ZT-DS-23 sample questions

Correct answer: The Policy Engine (PE)

According to NIST SP 800-207, the Policy Engine (PE) is the core component that computes whether a subject is granted access to a resource. It analyzes enterprise policy alongside inputs from external sources like threat intelligence and CDM. The Policy Administrator (PA) executes this decision by communicating with the Policy Enforcement Point (PEP), which physically or logically blocks or allows the traffic.

Correct answer: Zero Trust shifts the security focus from network boundaries to identities and data, mitigating the risk of lateral movement inherently allowed by traditional VPNs when an endpoint is compromised.

The primary business driver for Zero Trust in modern enterprises is the failure of traditional perimeter security (like VPNs) to contain breaches. Once an attacker breaches the perimeter, they have implicit trust to move laterally. Zero Trust's 'assume breach' tenet addresses this by enforcing least privilege and continuous verification at the identity and data levels, directly mitigating the financial and reputational damage of lateral movement. graph TD subgraph Traditional Perimeter VPN[VPN Gateway] -->|Implicit Trust| Internal[Internal Network] Attacker1[Attacker] -.->|Compromised Creds| VPN Internal -->|Lateral Movement| Data1[(Sensitive Data)] end subgraph Zero Trust Architecture Auth[Identity & Context Engine] -->|Explicit Trust| PEP[Policy Enforcement Point] Attacker2[Attacker] -.->|Compromised Creds| Auth Auth -.->|Access Denied| PEP PEP -->|Micro-segmented| Data2[(Sensitive Data)] end

Correct answer: False

False. De-perimeterization refers to the concept that the traditional network perimeter is no longer the sole boundary for security due to cloud adoption, remote work, and mobile devices. It does not mean dismantling existing firewalls. Zero Trust is an additive strategy that uses existing perimeter defenses as part of a defense-in-depth approach while pushing enforcement closer to the assets.

Correct answer: Retention Lock Compliance (Immutability)

Retention Lock Compliance enforces strict immutability, ensuring that data cannot be modified, deleted, or overwritten for a specified period, even by users with full administrative privileges. This directly maps to the Data pillar of Zero Trust by providing data-centric protection against insider threats and ransomware.

Correct answers: Identity; Network; Data

Identity is one of the five foundational pillars in the CISA Zero Trust Maturity Model.

Network is one of the five foundational pillars in the CISA Zero Trust Maturity Model, focusing on segmentation and traffic inspection.

Data is one of the five foundational pillars in the CISA Zero Trust Maturity Model, focusing on data protection, classification, and encryption.

Correct answer: A tenet is a core philosophy or guiding principle (e.g., 'never trust, always verify'), whereas a pillar is a functional domain where Zero Trust is applied (e.g., Network, Device).

In Zero Trust frameworks, tenets are the foundational principles or philosophies that guide the security strategy (such as 'assume breach', 'verify explicitly', and 'least privilege'). Pillars are the specific functional domains or control surfaces (such as Identity, Device, Network, Application/Workload, and Data) where those tenets are operationalized.