I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT practice questions

One question at a time. Build your CSA CCZT understanding.

First 50 of 198 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Zero Trust Architecture

In a Zero Trust Architecture, what is the primary role of the policy decision point (PDP)?

  1. It evaluates access requests against policy and contextual signals before granting access Correct answer.
  2. It logs packet captures for forensic investigations
  3. It stores encryption keys for the enterprise certificate authority
  4. It forwards all user traffic between segmented network zones

Explanation

Zero Trust separates the decision function from the enforcement function. The policy decision point evaluates each request using identity, device posture, and other context against policy, then issues a decision that the policy enforcement point applies to the connection.

Question 2Zero Trust Architecture

Which statement best captures the core premise of Zero Trust compared with perimeter-based security?

  1. No implicit trust is granted based on network location; access is evaluated per request Correct answer.
  2. All users must connect through a single VPN concentrator before reaching resources
  3. Trust is granted implicitly to any host inside the corporate network range
  4. Endpoint antivirus is the only control needed to authorize access

Explanation

Zero Trust removes the assumption that being on the internal network makes a subject trustworthy. Instead, every access request is evaluated explicitly using multiple signals regardless of where the request originates.

Question 3Zero Trust Architecture

A security team wants continuous verification of user identity rather than a one-time login. Which Zero Trust practice most directly supports this?

  1. Issuing permanent credentials that never expire for internal staff
  2. Placing all identity providers in a single flat network segment
  3. Lengthening password complexity requirements to twenty characters
  4. Re-authenticating and reassessing session context throughout the session lifetime Correct answer.

Explanation

Continuous verification means identity and context are re-evaluated during a session, not only at initial authentication. Sessions may be reauthenticated, stepped up, or terminated when risk signals change.

Question 4Zero Trust Architecture

Which component enforces the access decision at the resource boundary in a Zero Trust Architecture?

  1. The policy administrator
  2. The policy enforcement point Correct answer.
  3. The identity repository
  4. The configuration management database

Explanation

The policy enforcement point sits in the data path and applies the grant, deny, or modify decision it receives from the policy decision function. It is the component that actually gates the connection to the resource.

Question 5Zero Trust Architecture

What is the purpose of micro-segmentation in a Zero Trust Architecture?

  1. To consolidate all application traffic onto one inspection appliance
  2. To reduce the number of VLANs required in the data center
  3. To replace identity-based controls with IP address allowlists
  4. To create fine-grained boundaries so workloads can only reach explicitly permitted peers Correct answer.

Explanation

Micro-segmentation limits lateral movement by placing granular controls around individual workloads or small groups. Communication is permitted only where policy explicitly allows it, reducing blast radius if a host is compromised.

Question 6Zero Trust Architecture

Which signal is most characteristic of device trust assessment in a Zero Trust decision?

  1. The length of time the employee has worked at the company
  2. The physical rack location of the server
  3. The department code stored in the HR system
  4. The device posture, such as patch level and disk encryption status Correct answer.

Explanation

Device trust is derived from posture attributes such as patch state, encryption, management enrollment, and health signals. These are evaluated alongside identity and other context to decide whether access should be granted.

Question 7Zero Trust Architecture

Why does Zero Trust favor least privilege access for sessions?

  1. It guarantees that no insider threat can exist
  2. It reduces the scope of what a compromised identity can reach Correct answer.
  3. It eliminates the need for logging and monitoring
  4. It allows administrators to skip change management

Explanation

Least privilege limits each session to the resources and actions needed for the task. If credentials are stolen or a session is hijacked, the attacker inherits only that narrow scope rather than broad access.

Question 8Zero Trust Architecture

In Zero Trust terminology, what does an implicit trust zone traditionally represent?

  1. A group of users who have completed security awareness training
  2. A set of servers that share the same operating system
  3. A cluster of endpoints managed by the same tool
  4. A segment where every asset is assumed trustworthy because of its network location Correct answer.

Explanation

An implicit trust zone is the legacy concept where assets inside a network boundary are trusted by default. Zero Trust replaces this assumption with per-request evaluation of identity and context.

Question 9Zero Trust Architecture

An organization wants to protect a legacy application that cannot be modified to support modern authentication. Which Zero Trust approach is most appropriate?

  1. Move the application to the flat internal network and rely on firewall rules
  2. Disable logging on the application to reduce overhead
  3. Expose the application directly to the internet with a static shared password
  4. Place a proxy in front of it that enforces identity-aware policy on behalf of the app Correct answer.

Explanation

A fronting proxy can terminate modern authentication, evaluate policy, and broker access to a legacy resource that lacks native support. This lets the organization apply Zero Trust controls without rewriting the application.

Question 10Zero Trust Architecture

A user authenticates successfully, but the access request is denied because the device is unpatched. What Zero Trust behavior does this illustrate?

  1. The resource is offline
  2. The user's password has expired
  3. The identity provider is misconfigured
  4. Authentication alone does not imply authorization Correct answer.

Explanation

Zero Trust separates authentication from authorization. A valid identity is necessary but not sufficient; policy also weighs device posture and other context before granting access to a resource.

Question 11Zero Trust Architecture

A team is designing segmentation for a three-tier application. Which design best aligns with Zero Trust micro-segmentation?

  1. Place all three tiers on one subnet and rely on host firewalls being disabled
  2. Allow any internal host to reach the database for administrative convenience
  3. Allow the web tier to reach the database tier directly to reduce latency
  4. Permit only the application tier to reach the database on its service port, with all other flows denied Correct answer.

Explanation

Micro-segmentation permits only the flows required by the application architecture. Restricting database access to the application tier on a specific service port minimizes lateral movement paths.

Question 12Zero Trust Architecture

Which practice best reflects just-in-time privileged access in a Zero Trust program?

  1. Sharing a single administrator account across the team
  2. Storing administrator passwords in a spreadsheet on a shared drive
  3. Granting standing administrator rights to the operations team permanently
  4. Elevating privileges for a defined window after approval, then automatically revoking them Correct answer.

Explanation

Just-in-time access grants elevated rights only for the period needed, after an approval and authentication step, then removes them. This shrinks the window in which standing privilege can be abused.

Question 13Zero Trust Architecture

A Zero Trust policy must decide access to a sensitive data store. Which combination of signals best matches the paradigm's emphasis on context?

  1. Source IP subnet and port number only
  2. Time of day and server hostname only
  3. Username and password only
  4. User identity, device posture, and request context such as location and sensitivity Correct answer.

Explanation

Zero Trust decisions combine identity, device health, and request context including resource sensitivity. Weighing multiple signals produces a more accurate risk assessment than any single attribute.

Question 14Zero Trust Architecture

What is the main security benefit of brokering user-to-application access through an identity-aware proxy rather than direct network reachability?

  1. It guarantees the application has no vulnerabilities
  2. It hides the application behind a policy check that evaluates each request Correct answer.
  3. It eliminates the need to log user activity
  4. It removes the need for any authentication at the application

Explanation

An identity-aware proxy inserts a policy enforcement point between the user and the application. Each request is evaluated against identity and context before the connection is brokered to the resource.

Question 15Zero Trust Architecture

An analyst is mapping Zero Trust components. Which pairing is correct?

  1. SIEM stores the organization's signing keys
  2. Policy enforcement point applies the decision to the connection Correct answer.
  3. Identity provider enforces network segmentation rules
  4. Policy decision point performs enforcement in the data path

Explanation

The policy enforcement point is the data-path component that applies grant, deny, or modify decisions to connections. The decision itself is produced by the policy decision function.

Question 16Zero Trust Architecture

A Zero Trust rollout team finds that many applications still authenticate users with local accounts. What is the most aligned remediation?

  1. Federate application authentication to a central identity provider that issues contextual assertions Correct answer.
  2. Keep local accounts but enforce longer passwords
  3. Move the applications to a trusted network segment
  4. Disable multi-factor authentication to reduce friction

Explanation

Federating to a central identity provider gives the policy engine consistent identity and context signals across applications. Local accounts fragment identity and prevent uniform, context-aware decisions.

Question 17Zero Trust Architecture

Which monitoring capability is most important for validating that Zero Trust policies work as intended?

  1. Tracking the number of help desk tickets about printers
  2. Collecting and analyzing access logs and policy decisions across enforcement points Correct answer.
  3. Counting the number of network switches deployed
  4. Measuring the physical size of the data center

Explanation

Telemetry from enforcement points and decision engines reveals whether grants and denials match policy intent. Continuous analysis of these logs supports tuning and detection of anomalous access.

Question 18Zero Trust Architecture

A remote contractor needs access to a single internal dashboard for two weeks. Which approach best reflects Zero Trust principles?

  1. Issue a permanent VPN account with broad internal access
  2. Provide a shared credential used by all contractors
  3. Grant scoped, time-bound access through an identity-aware gateway after strong authentication Correct answer.
  4. Allow access from any device without posture checks

Explanation

Scoped, time-bound access through an identity-aware gateway applies least privilege and continuous evaluation. Strong authentication and device checks ensure the contractor meets policy before the connection is brokered.

Question 19Zero Trust Architecture

Which statement about the relationship between Zero Trust and encryption is most accurate?

  1. Zero Trust forbids encrypting internal traffic
  2. Encryption protects data in transit and at rest but does not by itself authorize access Correct answer.
  3. Encryption is only relevant to backup tapes
  4. Encryption replaces the need for authentication

Explanation

Encryption is a protective control for data confidentiality, not an authorization mechanism. Zero Trust still requires identity and context evaluation before a subject is allowed to reach the data.

Question 20Zero Trust Architecture

An organization deploys a policy engine that scores each request as low, medium, or high risk. What is the most appropriate use of that score?

  1. Ignore the score and grant access whenever authentication succeeds
  2. Use the score to assign static roles permanently
  3. Use the score to choose among deny, allow, or step-up authentication outcomes Correct answer.
  4. Use the score only for monthly reporting

Explanation

Risk scoring is most useful when it drives differentiated outcomes. Low risk may be allowed, elevated risk may trigger step-up authentication, and high risk may be denied, all within the same policy framework.

Question 21Zero Trust Architecture

A Zero Trust architect must decide where to place enforcement for a SaaS application that users reach directly over the internet. Which placement is most consistent with the paradigm?

  1. At the user's local hosts file
  2. At the SaaS provider's data center firewall only
  3. At the corporate network egress, since all users are on site
  4. At the identity provider and a cloud access broker that evaluate each request Correct answer.

Explanation

When users reach SaaS directly, enforcement must follow the request rather than sit at a network perimeter. Identity provider policy plus a cloud access broker evaluates identity and context for each session regardless of user location.

Question 22Zero Trust Architecture

A security team observes that a compromised endpoint with valid user credentials can reach many internal services. Which Zero Trust change most directly reduces this blast radius?

  1. Extending VPN session timeouts to reduce reconnects
  2. Increasing password rotation frequency for all users
  3. Adding more perimeter firewall rules for inbound internet traffic
  4. Applying workload-level segmentation and least-privilege authorization per request Correct answer.

Explanation

Lateral movement succeeds when a compromised host can reach many peers. Workload-level segmentation plus per-request authorization limits each session to explicitly permitted destinations and actions.

Question 23Zero Trust Architecture

Which scenario best demonstrates continuous authorization rather than one-time authorization?

  1. An administrator approves a role request that remains active indefinitely
  2. A user logs in once and retains access until the account is deleted
  3. A user is granted access based on the subnet of the requesting host
  4. A session is terminated when the device drops below the required patch baseline mid-session Correct answer.

Explanation

Continuous authorization re-evaluates context during a session and can revoke access when conditions change. Mid-session termination after a posture degradation is a direct example of that behavior.

Question 24Zero Trust Architecture

A Zero Trust program must balance security with usability. Which design decision best reflects that balance?

  1. Disable session logging to improve performance
  2. Deny all access from personal devices without exception
  3. Require hardware tokens for every internal request regardless of risk
  4. Apply step-up authentication only when risk signals exceed a defined threshold Correct answer.

Explanation

Risk-adaptive step-up authentication adds friction only when context warrants it. This preserves security for high-risk requests while keeping low-risk workflows usable.

Question 25Zero Trust Architecture

An auditor asks how a Zero Trust architecture handles a request from a managed device on an untrusted network. Which answer is most accurate?

  1. The request is automatically allowed because the device is managed
  2. The request is evaluated on identity, device posture, and context, then allowed or denied by policy Correct answer.
  3. The request is denied because the network is untrusted
  4. The request bypasses policy because the user is an employee

Explanation

Zero Trust does not decide based on network location alone. A managed device on an untrusted network still undergoes policy evaluation using identity, posture, and request context before any access is granted.

Question 26Zero Trust Architecture

Which pair of components forms the core decision and enforcement split in the NIST Zero Trust Architecture reference model?

  1. The identity provider, which issues tokens, and the certificate authority, which signs them
  2. The SIEM, which correlates logs, and the SOAR, which runs playbooks
  3. The VPN concentrator, which terminates tunnels, and the DNS resolver, which answers queries
  4. The policy engine, which evaluates signals and produces a decision, and the policy enforcement point, which applies that decision to the connection Correct answer.

Explanation

Zero Trust architecture separates the component that decides access (the policy engine, often paired with a policy administrator that issues the session credential or command) from the component that actually gates the traffic (the policy enforcement point). This separation lets policy be centralized and consistent while enforcement sits as close to the resource as possible. The other pairs describe supporting or unrelated infrastructure rather than the decision/enforcement split.

Question 27Zero Trust Architecture

A Zero Trust program wants every request to a finance application to be evaluated against current user identity, device posture, and data sensitivity before a session is allowed. Which design element is essential to make that per-request evaluation possible?

  1. A shared local administrator account for the finance team to simplify troubleshooting
  2. A static firewall rule set refreshed on a quarterly change cycle
  3. A policy decision point that receives fresh context signals at request time and can return allow, deny, or step-up outcomes Correct answer.
  4. An air-gapped network segment that removes the finance application from all routing

Explanation

Per-request, context-aware authorization requires a decision function that is fed live signals (identity, device health, sensitivity, behavior) each time access is requested, rather than relying on a one-time perimeter check. The decision point then returns an outcome such as allow, deny, or require additional authentication. Static rules, shared credentials, and total isolation do not provide dynamic, signal-driven evaluation.

Question 28Zero Trust Architecture

An enterprise is choosing where to enforce Zero Trust policy for internally hosted applications accessed by employees over the corporate WLAN and by remote workers over the internet. Which enforcement placement best supports consistent policy for both populations?

  1. Enforce only at the internet edge firewall, treating internal WLAN traffic as pre-authorized
  2. Enforce at the core switch ACLs, keyed to subnet membership
  3. Enforce only on remote worker laptops through a host agent, leaving office traffic unmediated
  4. Enforce at each application or in a proxy directly in front of it, so the same policy applies regardless of the user's network path Correct answer.

Explanation

Placing enforcement close to the protected resource, or in an identity-aware proxy fronting it, means the decision does not depend on which network the user came from, which is the core Zero Trust principle of removing network location as a trust signal. Edge-only, host-only, or subnet-based enforcement leaves a gap for one population or treats internal networks as implicitly trusted. Consistent placement in front of the application covers office and remote users with one policy.

Question 29Zero Trust Architecture

A security architect is told that the organization's Zero Trust policy engine currently receives identity and device signals but no information about the sensitivity of the resource being requested. What is the most significant consequence for policy quality?

  1. The engine cannot differentiate access to low-sensitivity and high-sensitivity resources, so it may over-grant to sensitive data or over-restrict routine resources Correct answer.
  2. The identity provider will be unable to issue any authentication tokens
  3. Device posture checks will stop working because they depend on resource classification
  4. Sessions will fail to encrypt because sensitivity drives key selection

Explanation

Resource sensitivity is a core input that lets policy scale requirements to the value of what is being reached, such as requiring stronger authentication or a compliant device for regulated data while allowing lighter checks for low-risk content. Without it, the engine applies one uniform bar, producing either excessive grants to sensitive systems or unnecessary friction everywhere. Encryption and token issuance are handled by other mechanisms and do not depend on this signal.

Question 30Software Defined Perimeter

In the Software Defined Perimeter model, what does the Controller do before it authorizes a requesting device to reach a protected resource?

  1. It replicates the protected resource across multiple data centers
  2. It verifies device and user identity, then issues a signed connection instruction to the accepting component Correct answer.
  3. It assigns the device a public IP address reachable from the internet
  4. It encrypts the application payload with the resource server's private key

Explanation

The Controller is the policy decision point of an SDP deployment: it authenticates the requesting user and device against policy, then sends a signed authorization to the gateway that fronts the resource. It does not carry application traffic itself, so payload encryption and address assignment are outside its role.

Question 31Software Defined Perimeter

What is the primary purpose of the single packet authorization (SPA) mechanism in an SDP architecture?

  1. To let a gateway stay dark by admitting only clients that prove knowledge of a secret in a first packet Correct answer.
  2. To compress application traffic before it reaches the gateway
  3. To provide load balancing across multiple accepting hosts
  4. To synchronize clocks between the Controller and the accepting host

Explanation

SPA requires the client to send a cryptographically signed packet that the gateway validates before any TCP handshake occurs, so unauthenticated scanners see no open port. This lets the protected service remain invisible until a legitimate request is proven.

Question 32Software Defined Perimeter

Which statement best describes the default visibility of an SDP-protected service to an unauthenticated host on the internet?

  1. It is reachable but requires a password at the application login page
  2. It responds to port scans with a TCP reset so attackers learn it exists
  3. It does not respond at all, appearing dark to unauthorized probes Correct answer.
  4. It appears as a normal open port until the user authenticates

Explanation

A core SDP property is that protected services are not exposed to unauthenticated network probes; the gateway drops traffic that lacks a valid SPA or authorization. Attackers therefore cannot enumerate the service before authentication.

Question 33Software Defined Perimeter

In SDP terminology, what is the Accepting Host (gateway) responsible for?

  1. Issuing identity assertions for users during onboarding
  2. Storing the authoritative policy that the Controller evaluates
  3. Enforcing the Controller's authorization and proxying or forwarding the client connection to the protected resource Correct answer.
  4. Acting as the certificate authority for device certificates

Explanation

The Accepting Host is the policy enforcement point: it validates the SPA and the Controller's signed authorization before allowing the client to reach the resource. It enforces decisions rather than making them.

Question 34Software Defined Perimeter

Which identity model does the SDP specification use to authenticate users and devices before granting access?

  1. Anonymous access gated only by source IP address
  2. A shared static API key distributed to every device
  3. Mutual certificate-based or equivalent strong authentication tied to an identity provider Correct answer.
  4. A single sign-on cookie issued by the resource server

Explanation

SDP relies on strong, often mutual, authentication of both the user and the device, typically anchored in an identity provider and certificate or equivalent credentials. Access decisions are made per identity, not per network location.

Question 35Software Defined Perimeter

What is the main security benefit of separating the SDP control plane from the data plane?

  1. It removes the need for encryption on the data path
  2. It allows the data plane to bypass all policy checks for performance
  3. It lets authorization decisions be made centrally while traffic flows directly between client and gateway Correct answer.
  4. It guarantees the Controller never needs patching

Explanation

Separating control (authorization) from data (traffic) means the Controller can enforce consistent policy without being in the packet path, and the data plane can scale independently. Traffic still passes through the enforcing gateway.

Question 36Software Defined Perimeter

Which deployment model places the SDP gateway in front of resources hosted in a public cloud while the Controller is operated by a third party?

  1. Transparent bridge with no Controller
  2. Site-to-site VPN concentrator
  3. Hub-and-spoke MPLS routing
  4. Client-to-gateway with a hosted or cloud-delivered Controller Correct answer.

Explanation

SDP supports cloud-delivered Controllers that authorize clients to gateways protecting cloud-hosted resources. This client-to-gateway pattern with a hosted Controller is common for SaaS and multi-cloud access.

Question 37Software Defined Perimeter

Why does SDP commonly use mutual TLS between the client and the accepting host?

  1. To allow the gateway to verify the client's certificate while the client verifies the gateway's certificate Correct answer.
  2. To replace the need for any user authentication
  3. To enable broadcast traffic between segments
  4. To reduce the CPU cost of the Controller

Explanation

Mutual TLS authenticates both ends of the connection: the client proves possession of its device or user certificate, and the gateway proves its identity to the client. This bidirectional assurance is central to SDP's device-centric trust.

Question 38Software Defined Perimeter

A client sends an SPA packet to a gateway, but the packet's timestamp is outside the accepted window. What should the gateway do?

  1. Reject the packet and not open any connection Correct answer.
  2. Accept the packet and log a warning for later review
  3. Forward the packet to the Controller for decryption
  4. Accept the packet because the signature is valid

Explanation

SPA validation includes freshness checks such as timestamps and nonces to prevent replay. A packet outside the accepted window is treated as invalid and dropped, so no connection is opened.

Question 39Software Defined Perimeter

A gateway receives a signed authorization from the Controller for user A to reach server S, but the client requests server T. How should the gateway respond?

  1. Deny access because the authorization does not cover server T Correct answer.
  2. Allow access to T because the user is already authenticated
  3. Allow access to T only if the client uses mTLS
  4. Allow access to T and notify the Controller afterward

Explanation

SDP authorizations are scoped to specific resources; the gateway enforces exactly what the Controller signed. A request for a different resource falls outside the authorization and must be denied.

Question 40Software Defined Perimeter

Which sequence correctly reflects the SDP connection workflow?

  1. Gateway authenticates the client, then asks the resource to contact the Controller
  2. Client connects to resource, then Controller authenticates the client
  3. Controller pushes policy to the client, and the client connects directly to the resource
  4. Client authenticates to the Controller, receives authorization, sends SPA to the gateway, then establishes the connection Correct answer.

Explanation

The SDP flow is authenticate first, authorize second, then connect: the client proves identity, the Controller issues a signed authorization, and the gateway admits the connection only after validating SPA and authorization.

Question 41Software Defined Perimeter

An organization wants contractors to reach only one internal web application without exposing the rest of the data center. Which SDP design element most directly achieves this?

  1. A flat network segment shared by all applications
  2. A single gateway granting access to the entire subnet after login
  3. An open VPN concentrator with split tunneling disabled
  4. A gateway dedicated to that application with a Controller policy scoped to it Correct answer.

Explanation

SDP achieves least privilege by pairing per-application gateways with narrowly scoped Controller policy, so an authorized contractor reaches only that application. Broad subnet access would reintroduce lateral movement risk.

Question 42Software Defined Perimeter

How does SDP reduce the risk of lateral movement after an endpoint is compromised?

  1. By granting each authorized connection only to the specific resource the policy allows Correct answer.
  2. By disabling logging on internal segments
  3. By placing all resources on one VLAN
  4. By encrypting all east-west traffic with a single shared key

Explanation

Because each connection is individually authorized for a specific resource, a compromised endpoint cannot freely reach other systems; it only holds authorizations for what it was granted. This limits lateral movement.

Question 43Software Defined Perimeter

A security team notices repeated SPA packets from the same source with identical nonces. What is the most likely concern?

  1. The gateway has run out of IP addresses
  2. The client is compressing packets incorrectly
  3. The packets are replayed and should be rejected by the gateway Correct answer.
  4. The Controller is load balancing incorrectly

Explanation

Identical nonces indicate replay attempts, since a legitimate client generates a fresh nonce per SPA packet. Gateways must track and reject reused nonces to prevent an attacker from resending a captured authorization.

Question 44Software Defined Perimeter

Which component typically makes the final access decision when a user requests a protected resource in an SDP architecture?

  1. The resource server's local firewall
  2. The DNS resolver
  3. The client's operating system
  4. The SDP Controller acting as policy decision point Correct answer.

Explanation

The Controller evaluates identity, device posture, and policy to decide whether access is granted, then issues an authorization. Enforcement happens downstream at the gateway, but the decision is the Controller's.

Question 45Software Defined Perimeter

What role does device posture checking play in an SDP authorization decision?

  1. It determines which IP address the gateway uses
  2. It encrypts the connection between client and gateway
  3. It replaces user authentication entirely
  4. It provides context such as patch level or managed status that policy can require before granting access Correct answer.

Explanation

SDP can incorporate device context, such as whether the endpoint is managed, patched, or running approved software, into the authorization decision. This lets policy deny access from noncompliant devices even when user credentials are valid.

Question 46Software Defined Perimeter

Why is SDP often described as implementing a "need-to-know" or deny-by-default access model?

  1. Because it permits all traffic unless a signature is missing
  2. Because access is granted only after explicit authorization for a specific resource, and everything else is denied Correct answer.
  3. Because it blocks all traffic permanently after deployment
  4. Because it relies on users choosing which resources to expose

Explanation

In SDP nothing is reachable until the Controller explicitly authorizes a specific client-resource pair; all other traffic is dropped by default. This is the operational meaning of deny-by-default and need-to-know.

Question 47Software Defined Perimeter

A company deploys SDP but leaves the protected application's port open to the internet in addition to the gateway. What weakness does this introduce?

  1. It improves performance without security impact
  2. None, because the gateway still authenticates users
  3. The application can be reached directly, bypassing SDP enforcement Correct answer.
  4. It automatically enables SPA on the application

Explanation

If the application remains directly reachable, an attacker can bypass the gateway and its authorization checks entirely, negating SDP's protection. The service must be made dark so only the gateway path exists.

Question 48Software Defined Perimeter

Which capability distinguishes SDP from a traditional VPN concentrator?

  1. SDP encrypts traffic while VPNs do not
  2. SDP requires no authentication of users
  3. SDP only works for web protocols
  4. SDP authorizes access per application and identity rather than placing the user on the broader network Correct answer.

Explanation

A VPN typically grants network-level access, placing the user on a segment from which many hosts are reachable. SDP instead authorizes specific application connections per identity, limiting what an authenticated user can reach.

Question 49Software Defined Perimeter

How does an SDP gateway validate that an authorization message genuinely came from the Controller?

  1. By comparing the message to a shared plaintext password
  2. By checking that the message arrived on the management VLAN
  3. By verifying the Controller's digital signature over the authorization Correct answer.
  4. By trusting any message that contains a username

Explanation

Authorizations are signed by the Controller, and the gateway verifies that signature with the Controller's public key before acting. This prevents forged authorizations from being accepted.

Question 50Software Defined Perimeter

An attacker captures a valid SPA packet and replays it hours later. Which combination of controls best prevents this from succeeding?

  1. Freshness checks such as timestamps and nonce tracking at the gateway Correct answer.
  2. Using a static shared secret for all clients
  3. Longer packet payloads and larger keys
  4. Disabling logging to reduce noise

Explanation

Replay defense relies on freshness: the gateway rejects SPA packets whose timestamp is stale and tracks nonces so a captured packet cannot be reused. Signature validity alone is insufficient because the captured packet is legitimately signed.