Cloud Security Alliance Cloud Security Alliance Certifications CCZT Questions & Answers

• Question 21:

  In a ZTA, where should policies be created?

  A. Data plane

  B. Network

  C. Control plane

  D. Endpoint

  Correct Answer: C

  In a ZTA, policies should be created in the control plane, which is the logical component that defines and manages the policies for accessing resources. The control plane consists of policy entities, such as policy administrators, policy engines, and policy decision points, that are responsible for crafting, maintaining, evaluating, and enforcing the policies1. Thecontrol plane interacts with the data plane, which is the logical component that handles the data transmission and processing, and the network, which is the physical or virtual component that provides the connectivity and transport for the data plane1. The endpoint is the device or system that requests or provides access to a resource1. References: Zero Trust Architecture | NIST

• Question 22:

  Within the context of risk management, what are the essential components of an organization's ongoing risk analysis?

  A. Gap analysis, security policies, and migration

  B. Assessment frequency, metrics, and data

  C. Log scoping, log sources, and anomalies

  D. Incident management, change management, and compliance

  Correct Answer: B

  The essential components of an organization's ongoing risk analysis are assessment frequency, metrics, and data. Assessment frequency refers to how often the organizationconducts risk assessments to monitor and measure the

  effectiveness of the zero trust architecture and policies. Metrics refer to the quantitative and qualitative indicators that are used to evaluate the security posture, performance, and compliance of the zero trust architecture. Data refers to the

  information that is collected, analyzed, and reported from various sources, such as telemetry, logs, audits, and feedback, to support risk analysis and decision making.

  References:

  Zero Trust Planning - Cloud Security Alliance, section "Monitor and Measure" How to improve risk management using Zero Trust architecture | Microsoft Security Blog, section "Monitoring and reporting" Zero Trust Adoption: Managing Risk with

  Cybersecurity Engineering and Adaptive Risk Assessment - SEI Blog, section "Continuous Monitoring and Improvement"

• Question 23:

  When planning for a ZTA, a critical product of the gap analysis process is______ Select the best answer.

  A. a responsible, accountable, consulted, and informed (RACI) chart and communication plan

  B. supporting data for the project business case

  C. the implementation's requirements

  D. a report on impacted identity and access management (IAM) infrastructure

  Correct Answer: C

  A critical product of the gap analysis process is the implementation's requirements, which are the specifications and criteria that define the desired outcomes, capabilities, and functionalities of the ZTA. The implementation's requirements are

  derived from the gap analysis, which identifies the current state, the target state, and the gaps between them. The implementation's requirements help to guide the design, development, testing, and deployment of the ZTA, as well as the

  evaluation of its effectiveness and alignment with the business objectives and needs.

  References:

  Zero Trust Planning - Cloud Security Alliance, section "Scope, Priority, and Business Case"

  The Zero Trust Journey: 4 Phases of Implementation - SEI Blog, section "Second Phase: Assess"

  Planning for a Zero Trust Architecture: A Planning Guide for Federal ..., section "Gap Analysis"

• Question 24:

  What should be a key component of any ZT project, especially during implementation and adjustments?

  A. Extensive task monitoring

  B. Frequent technology changes

  C. Proper risk management

  D. Frequent policy audits

  Correct Answer: C

  Proper risk management should be a key component of any ZT project, especially during implementation and adjustments, because it helps to identify, analyze, evaluate, and treat the potential risks that may affect the ZT and ZTA objectives and outcomes. Proper risk management also helps to prioritize the ZT and ZTA activities and resources based on the risk level and impact, and to monitor and review the risk mitigation strategies and actions. References: Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 9: Risk Management

• Question 25:

  Scenario: An organization is conducting a gap analysis as a part of its ZT planning. During which of the following steps will risk appetite be defined?

  A. Create a roadmap

  B. Determine the target state

  C. Determine the current state

  D. Define requirements

  Correct Answer: D

  During the define requirements step of ZT planning, the organization will define its risk appetite, which is the amount and type of risk that it is willing to accept in pursuit of its objectives. Risk appetite reflects the organization's risk culture,

  tolerance, and strategy, and guides the development of the ZT policies and controls. Risk appetite should be aligned with the business priorities and needs, and communicated clearly to the stakeholders.

  References:

  Certificate of Competence in Zero Trust (CCZT) prepkit, page 7, section 1.3 Risk Appetite Guidance Note - GOV.UK, section "Introduction" How to improve risk management using Zero Trust architecture | Microsoft Security Blog, section

  "Risk management is an ongoing activity"

• Question 26:

  ZTA reduces management overhead by applying a consistent access model throughout the environment for all assets. What can be said about ZTA models in terms of access decisions?

  A. The traffic of the access workflow must contain all the parameters for the policy decision points.

  B. The traffic of the access workflow must contain all the parameters for the policy enforcement points.

  C. Each access request is handled just-in-time by the policy decision points.

  D. Access revocation data will be passed from the policy decision points to the policy enforcement points.

  Correct Answer: C

  ZTA models in terms of access decisions are based on the principle of "never trust, always verify", which means that each access request is handled just-in-time by the policy decision points. The policy decision points are the components in a ZTA that evaluate the policies and the contextual data collected from various sources, such as the user identity, the device posture, the network location, the resource attributes, and the environmental factors, and then generate an access decision. The access decision is communicated to the policy enforcement points, which enforce the decision on the resource. This way, ZTA models apply a consistent access model throughout the environment for all assets, regardless of their location, type, or ownership. References: Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2 What Is Zero Trust Architecture (ZTA)? - F5, section "Policy Engine" Zero trust security model - Wikipedia, section "What Is Zero Trust Architecture?" Zero Trust Maturity Model | CISA, section "Zero trust security model"

• Question 27:

  Which vital ZTA component enhances network security and simplifies management by creating boundaries between resources in the same network zone?

  A. Micro-segmentation

  B. Session establishment or termination

  C. Decision transmission

  D. Authentication request/validation request (AR/VR)

  Correct Answer: A

  Micro-segmentation is a vital ZTA component that enhances network security and simplifies management by creating boundaries between resources in the same network zone. Micro-segmentation divides the network into smaller segments or zones based on the attributes and context of the resources, such as data sensitivity, application functionality, user roles, etc. Micro-segmentation helps to isolate and protect the resources from unauthorized access and lateral movement of attackers within the same network zone. References: Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 6: Micro-segmentation

• Question 28:

  At which layer of the open systems interconnection (OSI) model does network access control (NAC) typically operate? Select the best answer.

  A. Layer 6, the presentation layer

  B. Layer 2, the data link layer

  C. Layer 3, the network layer

  D. Layer 4, the transport layer

  Correct Answer: B

  Network access control (NAC) typically operates at layer 2, the data link layer, of the open systems interconnection (OSI) model. The data link layer is responsible for transferring data between adjacent nodes on a network, such as switches and endpoints. NAC operates at this layer by inspecting and controlling the access of devices to the network based on their MAC addresses, device profiles, security posture, and compliance status. References: Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 6: Micro-segmentation

• Question 29:

  Network architects should consider__________ before selecting an SDP model.

  Select the best answer.

  A. leadership buy-in

  B. gateways

  C. their use case

  D. cost

  Correct Answer: C

  Different SDP deployment models have different advantages and disadvantages depending on the organization's use case, such as the type of resources to be protected, the location of the clients and servers, the network topology, the

  scalability, the performance, and the security requirements. Network architects should consider their use case before selecting an SDP model that best suits their needs and goals.

  References:

  Certificate of Competence in Zero Trust (CCZT) prepkit, page 21, section 3.1.2 6 SDP Deployment Models to Achieve Zero Trust | CSA, section "Deployment Models Explained"

  Software-Defined Perimeter (SDP) and Zero Trust | CSA, page 7, section 3.1 Why SDP Matters in Zero Trust | SonicWall, section "SDP Deployment Models"

• Question 30:

  During ZT planning, which of the following determines the scope of the target state definition? Select the best answer.

  A. Risk appetite

  B. Risk assessment

  C. Service level agreements D. Risk register

  Correct Answer: B

  Risk assessment is the process of identifying, analyzing, and evaluating the risks that an organization faces in achieving its objectives. Risk assessment helps to determine the scope of the target state definition for ZT planning, as it identifies the critical assets, threats, vulnerabilities, and impacts that need to be addressed by ZT capabilities and activities. Risk assessment also helps to prioritize and align the ZT planning with the organization's risk appetite and tolerance levels.