Discuss CSA CCZT Exam Topic 2 Question 20

Which of the following is a key principle of ZT and is required for its

implementation?

AImplementing strong anti-phishing email filters

BMaking no assumptions about an entity's trustworthiness when it
requests access to a resource

CEncrypting all communications between any two endpoints

DRequiring that authentication and explicit authorization must occur
after network access has been granted

Suggested Answer: B

One of the core principles of Zero Trust (ZT) is to ''never trust, always verify'' every request for access to a resource, regardless of where it originates or what resource it accesses1.This means that ZT does not rely on implicit trust based on network perimeters, device types, or user roles, but rather on explicit verification based on multiple data points, such as user identity, device health, location, service, data classification, and anomalies1.

Reference=

Zero Trust Architecture | NIST

Zero Trust Model - Modern Security Architecture | Microsoft Security

How To Implement Zero Trust: 5-steps Approach & its challenges - Fortinet

Get Premium CCZT Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

34 comments · newest first

Barrett 10 months ago

I agree with B, trust no one!

Eliz 11 months ago

Wait, encrypting all communications isn't a must? That seems off.

Amber 11 months ago

A is good, but not a key principle for ZT.

Danica 11 months ago

I think D is more important, though.

Sunny 11 months ago

Definitely B, no trust assumptions is crucial!

Dorsey 12 months ago

I recall that ZT is all about verifying trust, so B makes sense. But I also remember something about needing strong filters, which might relate to A.

Geraldo 12 months ago

I practiced a similar question, and I think D is also relevant because ZT requires strict authentication and authorization. But I’m torn between B and D.

Gerardo 12 months ago

I’m not entirely sure, but I feel like C about encrypting communications is important too. It’s just that ZT is more about access control, right?

Thurman 1 year ago

I think I remember that ZT stands for Zero Trust, and it emphasizes not trusting anything by default. So, B seems like a strong candidate.

Kanisha 1 year ago

I'm a little confused by this question. Is the key principle they're looking for something more specific to ZT implementation? I'll have to review my notes to see if I can figure out the right answer.

Johnson 1 year ago

Okay, I remember from the lectures that ZT is all about not automatically trusting anything on the network. So option B, making no assumptions about trustworthiness, that's got to be the right answer.

Tyisha 1 year ago

This question seems straightforward - the key principle of ZT is making no assumptions about trustworthiness, so I'll go with option B.

Gabriele 1 year ago

Hmm, I'm a bit unsure about this one. I know ZT is about verifying access rather than trusting, but I'm not sure if that's the exact principle they're looking for. I'll have to think it through carefully.

Ciara 1 year ago

Okay, let me think this through. Linearity, repeatability, and movement don't seem quite right. I'm leaning towards bias, since that's about the difference between the measured and actual values. But I want to double-check that in my textbook before marking the answer.

Quentin 1 year ago

This seems like a tricky question. I'll need to carefully read through the details and think about the implications of each option.

Royal 2 years ago

Yes, that's also crucial for ZT implementation. It helps ensure secure communication.

Daniel 2 years ago

Haha, I almost picked C. Encrypting everything? That's a bit overkill, even for Zero Trust!

Pura 2 years ago

↳ replying to Daniel

D) Requiring that authentication and explicit authorization must occur after network access has been granted

Nadine 2 years ago

↳ replying to Daniel

B) Making no assumptions about an entity's trustworthiness when it requests access to a resource

Merrilee 2 years ago

↳ replying to Daniel

A) Implementing strong anti-phishing email filters

Wai 2 years ago

↳ replying to Daniel

I almost picked C too, but I see why B is important now.

Kanisha 2 years ago

↳ replying to Daniel

Yeah, I think B is the key principle for ZT.

Jeanice 2 years ago

↳ replying to Daniel

I agree, C does seem a bit extreme for Zero Trust.

Thora 2 years ago

I agree, B is the correct choice. Making no assumptions about trustworthiness is crucial for Zero Trust implementation.

Adelle 2 years ago

↳ replying to Thora

I agree, not assuming trustworthiness is important for implementation.

Basilia 2 years ago

↳ replying to Thora

I think B is the key principle of ZT.

Roxane 2 years ago

But what about encrypting all communications between endpoints? Isn't that important too?

Cherilyn 2 years ago

B is the right answer. Zero Trust principles focus on not trusting anything by default, and verifying access for every request.

Tequila 2 years ago

↳ replying to Cherilyn

Implementing strong anti-phishing email filters is important too.

Desirae 2 years ago

↳ replying to Cherilyn

That's correct, not making assumptions about trustworthiness is key.

Alesia 2 years ago

↳ replying to Cherilyn

Yes, Zero Trust is all about verifying access for every request.

Elena 2 years ago

↳ replying to Cherilyn

I think B is the right answer.

Flo 2 years ago

I agree with Royal. It's important to not trust any entity by default.

Royal 2 years ago

I think the key principle of ZT is making no assumptions about an entity's trustworthiness.

CSA CCZT Exam - Topic 2 Question 20 Discussion