Zscaler Zero Trust Cyber Associate - ZTCA 模擬練習

A. (a) all things on the internet, (b) all things internal.

B. (a) Google, (b) non-Google.

C. (a) SaaS, (b) PaaS.

D. (a) Known: the application has been categorized, classified, and updated dynamically; (b) Unknown:
the application does not meet an existing category and must be profiled, learned, and controlled conditionally.

A. Data Loss Prevention (out-of-band and inline).

B. Verifying identity and context through a secure identity provider.

C. Virtual firewalls.

D. SSL/TLS inspection.

A. Interoperability issues between IPSec standards like IKEv1 and IKEv2.

B. Hairpinning cloud application traffic through a data center bottleneck.

C. A split tunnel VPN where you break out traffic destined for certain IP addresses to go direct.

D. VPN vendors throttle network traffic on the overlay by default to reduce overhead on the VPN headend.

A. Connecting an initiator to internal and external applications from the Zero Trust Exchange.

B. The setup of an enterprise SSO or AD server for credential validation.

C. A handshake between the initiator and destination application.

D. Verification of identity and context of the connection.

A. Open and clear communication channels across Network and Security teams.

B. Application access happens on-premises, typically either from within the data center or the corporate campus, where large security stacks are deployed.

C. Leveraging policy enforcement capabilities available through traditional security appliances.

D. The policy remains the same, conditionally, and is applied equally regardless of the location of the enforcement point.

A. No means; the only access possible is via a special daemon running within the application space of the SaaS application itself.

B. A dynamic and effective path, ensuring beneficial experience and performance for the initiator.

C. A hardwired network connection.

D. A perimeter-based stateful network firewall, such as a security appliance.

A. Deceive: Direct any malicious attack to a restricted decoy.

B. Quarantine: Ensure access is stopped and assessed.

C. Firehose: Send TCP resets to the initiator.

D. Allow the connection.

A. Inspection of SSL/TLS connections.

B. Local breakout so that traffic goes directly to SaaS applications from branches.

C. Context and Identity.

D. Segmenting an OT network so that it is air-gapped from the IT environment.