Question 1

The following list describes the SDP onboarding process/procedure. What is the third step? 1. SDP controllers are brought online first. 2. Accepting hosts are
enlisted as SDP gateways that connect to and authenticate with the SDP controller. 3.

Accepted Answer

The third step in the SDP onboarding process is to onboard and authenticate the initiating hosts, which are the clients that request access to the protected
resources. The initiating hosts connect to and authenticate with the SDP gateway, which acts as an accepting host and a proxy for the protected resources. The
SDP gateway verifies the identity and posture of the initiating hosts and grants them access to the resources based on the policies defined by the SDP controller.
References =
? Certificate of Competence in Zero Trust (CCZT) prepkit, page 21, section 3.1.2
? 6 SDP Deployment Models to Achieve Zero Trust | CSA, section ??Deployment Models Explained??
? Software-Defined Perimeter (SDP) and Zero Trust | CSA, page 7, section 3.1

Question 2

Which architectural consideration needs to be taken into account while deploying SDP? Select the best answer.

Accepted Answer

A key architectural consideration that needs to be taken into account while deploying SDP is how SDP deployment fits into existing network topologies and
technologies. This is because SDP deployment may require changes or adaptations to the existing network infrastructure, such as routers, switches, firewalls,
VPNs, etc. SDP deployment may also affect the network performance, availability, scalability, and resilience. Therefore, it is important to assess the impact and
compatibility of SDP deployment with the existing network topologies and technologies, and to plan and design the SDP deployment accordingly.
References = Certificate of Competence in Zero Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 7: Network Infrastructure and SDP

Question 3

To successfully implement ZT security, two crucial processes must be planned and aligned with existing access procedures that the ZT implementation might
impact. What are these two processes?

Accepted Answer

Correct answer: B

Question 4

To respond quickly to changes while implementing ZT Strategy, an organization requires a mindset and culture of

Accepted Answer

To respond quickly to changes while implementing ZT Strategy, an organization requires a mindset and culture of continuous risk evaluation and policy
adjustment. This means that the organization should constantly monitor the threat landscape, assess the security posture, and update the policies and controls
accordingly to maintain a high level of protection and resilience. The organization should also embrace feedback, learning, and improvement as part of the ZT
journey.
References =
? Certificate of Competence in Zero Trust (CCZT) prepkit, page 7, section 1.3
? Cultivating a Zero Trust mindset - AWS Prescriptive Guidance, section ??Continuous learning and improvement??
? Zero Trust architecture: a paradigm shift in cybersecurity - PwC, section ??Continuous monitoring and improvement??

Question 5

Which element of ZT focuses on the governance rules that define the "who, what, when, how, and why" aspects of accessing target resources?

Accepted Answer

Policy is the element of ZT that focuses on the governance rules that define the ??who, what, when, how, and why?? aspects of accessing target resources. Policy
is the core component of a ZTA that determines the access decisions and controls for each request based on various attributes and factors, such as user identity,
device posture, network location, resource sensitivity, and environmental context. Policy is also the element that enables the ZT principles of ??never trust, always
verify?? and ??scrutinize explicitly?? by enforcing granular, dynamic, and data-driven rules for each access request. References =
? Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2
? What Is Zero Trust Architecture (ZTA)? - F5, section ??Policy Engine??
? Zero Trust Architecture Project - NIST Computer Security Resource Center, slide 9
? [Zero Trust Frameworks Architecture Guide - Cisco], page 4, section ??Policy Decision Point??

Question 6

ZT project implementation requires prioritization as part of the overall ZT project planning activities. One area to consider is ________
Select the best answer.

Accepted Answer

ZT project implementation requires prioritization as part of the overall ZT project planning activities. One area to consider is prioritization based on risks, which
means that the organization should identify and assess the potential threats, vulnerabilities, and impacts that could affect its assets, operations, and reputation,
and prioritize the ZT initiatives that address the most critical and urgent risks. Prioritization based on risks helps to align the ZT project with the business objectives
and needs, and optimize the use of resources and time.
References =
? Zero Trust Planning - Cloud Security Alliance, section ??Scope, Priority, & Business Case??
? The Zero Trust Journey: 4 Phases of Implementation - SEI Blog, section ??Second Phase: Assess??
? Planning for a Zero Trust Architecture: A Planning Guide for Federal ??, section ??Gap Analysis??

Question 7

In a ZTA, what is a key difference between a policy decision point (PDP) and a policy enforcement point (PEP)?

Accepted Answer

In a ZTA, a policy decision point (PDP) is a logical component that evaluates the incoming signals from an entity requesting access to a resource against a set of
access determination criteria, such as identity, context, device, location, and behavior1. A PDP then makes a decision to grant or deny access, or to request
additional information or verification, based on the policies defined by the policy administrator1. A policy enforcement point (PEP) is a logical component that uses
the incoming signals from the PDP to open or close a connection between the entity and the resource1. A PEP acts as a gateway or intermediary that enforces the
decision made by the PDP and prevents unauthorized or risky access2.
References =
? Zero Trust Architecture | NIST
? Policy Enforcement Point (PEP) - Pomerium

Question 8

In SaaS and PaaS, which access control method will ZT help define for access to the features within a service?

Accepted Answer

ABAC is an access control method that uses attributes of the requester, the resource, the environment, and the action to evaluate and enforce policies. ABAC
allows for fine-grained and dynamic access control based on the context of the request, rather than predefinedroles or privileges. ABAC is suitable for SaaS and
PaaS, where the features within a service may vary depending on the customer??s needs, preferences, and subscription level. ABAC can help implement ZT by
enforcing the principle of least privilege and verifying every request based on multiple factors.
References =
? Attribute-Based Access Control (ABAC) Definition
? General Access Control Guidance for Cloud Systems
? A Guide to Secure SaaS Access Control Within an Organization

Question 9

ZTA reduces management overhead by applying a consistent access model throughout the environment for all assets. What can
be said about ZTA models in terms of access decisions?

Certshared now are offering 100% pass ensure CCZT dumps!
/exam/CCZT/ (60 Q&As)

Accepted Answer

ZTA models in terms of access decisions are based on the principle of ??never trust, always verify??, which means that each access request is handled just-intime by the policy decision points. The policy decision points are the components in a ZTA that evaluate the policies and the contextual data collected from various
sources, such as the user identity, the device posture, the network location, the resource attributes, and the environmental factors, and then generate an access
decision. The access decision is communicated to the policy enforcement points, which enforce the decision on the resource. This way, ZTA models apply a
consistent access model throughout the environment for all assets, regardless of their location, type, or ownership.
References =
? Certificate of Competence in Zero Trust (CCZT) prepkit, page 14, section 2.2.2
? What Is Zero Trust Architecture (ZTA)? - F5, section ??Policy Engine??
? Zero trust security model - Wikipedia, section ??What Is Zero Trust Architecture???
? Zero Trust Maturity Model | CISA, section ??Zero trust security model??

Question 10

At which layer of the open systems interconnection (OSI) model does network access control (NAC) typically operate? Select the best answer.

Accepted Answer

Network access control (NAC) typically operates at layer 2, the data link layer, of the open systems interconnection (OSI) model. The data link layer is responsible
for transferring data between adjacent nodes on a network, such as switches and endpoints. NAC operates at this layer by inspecting and controlling the access of
devices to the network based on their MAC addresses, device profiles, security posture, and compliance status. References = Certificate of Competence in Zero
Trust (CCZT) - Cloud Security Alliance, Zero Trust Training (ZTT) - Module 6: Micro-segmentation