QUESTION: 21

For ZTA, what should be used to validate the identity of an entity?

Password management system
Multifactor authentication
Single sign-on
Bio-metric authentication

Answer(s): B

Explanation:

Multifactor authentication is a method of validating the identity of an entity by requiring two or more factors, such as something the entity knows (e.g., password, PIN), something the entity has (e.g., token, smart card), or something the entity is (e.g., biometric, behavioral). Multifactor authentication enhances the security of Zero Trust Architecture (ZTA) by reducing the risk of identity compromise and unauthorized access.

Reference:

Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 4: Identity and Access Management

Reveal Solution Next Question

QUESTION: 22

Scenario: An organization is conducting a gap analysis as a part of its ZT planning. During which of the following steps will risk appetite be defined?

Create a roadmap
Determine the target state
Determine the current state
Define requirements

Answer(s): D

Explanation:

During the define requirements step of ZT planning, the organization will define its risk appetite,

which is the amount and type of risk that it is willing to accept in pursuit of its objectives. Risk appetite reflects the organization's risk culture, tolerance, and strategy, and guides the development of the ZT policies and controls. Risk appetite should be aligned with the business priorities and needs, and communicated clearly to the stakeholders.

Reference:

Certificate of Competence in Zero Trust (CCZT) prepkit, page 7, section 1.3 Risk Appetite Guidance Note - GOV.UK, section "Introduction" How to improve risk management using Zero Trust architecture | Microsoft Security Blog, section "Risk management is an ongoing activity"

Reveal Solution Next Question

QUESTION: 23

Which activity of the ZT implementation preparation phase ensures the resiliency of the organization's operations in the event of disruption?

Change management process
Business continuity and disaster recovery
Visibility and analytics
Compliance

Answer(s): B

Explanation:

Business continuity and disaster recovery are the activities of the ZT implementation preparation phase that ensure the resiliency of the organization's operations in the event of disruption. Business continuity refers to the process of maintaining or restoring the essential functions of the organization during and after a crisis, such as a natural disaster, a cyberattack, or a pandemic. Disaster recovery refers to the process of recovering the IT systems, data, and infrastructure that support the business continuity. ZT implementation requires planning and testing the business continuity and disaster recovery strategies and procedures, as well as aligning them with the ZT policies and controls.

Reference:

Zero Trust Planning - Cloud Security Alliance, section "Monitor & Measure" Zero Trust architecture: a paradigm shift in cybersecurity - PwC, section "Continuous monitoring and improvement"
Zero Trust Implementation, section "Outline Zero Trust Architecture (ZTA) implementation steps"

Reveal Solution Next Question

QUESTION: 24

Which element of ZT focuses on the governance rules that define the "who, what, when, how, and why" aspects of accessing target resources?

Policy
Data sources
Scrutinize explicitly
Never trust, always verify

Answer(s): A

Explanation:

Policy is the element of ZT that focuses on the governance rules that define the "who, what, when, how, and why" aspects of accessing target resources. Policy is the core component of a ZTA that determines the access decisions and controls for each request based on various attributes and factors, such as user identity, device posture, network location, resource sensitivity, and environmental context. Policy is also the element that enables the ZT principles of "never trust,

always verify" and "scrutinize explicitly" by enforcing granular, dynamic, and data-driven rules for each access request.

Reference:

Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2 What Is Zero Trust Architecture (ZTA)? - F5, section "Policy Engine" Zero Trust Architecture Project - NIST Computer Security Resource Center, slide 9 [Zero Trust Frameworks Architecture Guide - Cisco], page 4, section "Policy Decision Point"

Reveal Solution Next Question

Free CCZT Exam Braindumps (page: 7)

QUESTION: 21

Explanation:

Reference:

QUESTION: 22

Explanation:

Reference:

QUESTION: 23

Explanation:

Reference:

QUESTION: 24

Explanation:

Reference:

CCZT Exam Discussions & Posts