A Zero Trust solution must account for an enterprise's risk tolerance via:

• A. The enterprise security architecture team should create a standard formula to calculate a fixed risk score for each unique initiator based on previous security incidents.
• B. A dynamic risk score, which feeds into a decision engine that determines whether access should be granted.
• C. A Zero Trust certification process, whereby every employee at the company is Zero Trust certified.
• D. Industry analyst firms such as Gartner and Forrester should provide the best guidance.

Cloud infrastructure security posture, as well as cloud infrastructure user entitlements, can help contribute to a determination of connection risk; these are typically determined via:

• A. Automated DevOps pipelines.
• B. API integrations between the Zero Trust platform and the major cloud providers.
• C. Premium cloud provider subscriptions.
• D. Multi-factor authentication.

What are two categories of destination applications in Zero Trust?

• A. (a) SaaS, (b) PaaS.
• B. (a) Google, (b) non-Google.
• C. (a) Known: the application has been categorized, classified, and updated dynamically; (b) Unknown:
  the application does not meet an existing category and must be profiled, learned, and controlled conditionally.
• D. (a) all things on the internet, (b) all things internal.

What types of attributes can be used to assess whether access is risky? (Select 2)

• A. Leveraging APIs available on the Layer 3 devices on the network to scan for malicious services or hosts in the environment.
• B. Seeing patterns in user behavior around things such as blocked malware downloads and blocked access to phishing sites.
• C. The endpoint operating system of the initiator.
• D. An analysis of device posture to examine attributes such as domain joined status, a certificate, whether the device has AV/EDR installed, and whether the device is running disk encryption.

Assessing, calculating, and delivering a risk score is: (Select 2)

• A. An assessment of inline and out-of-band network traffic.
• B. Only focused on initiator context.
• C. An assessment of the content, not just the connection, of services, so that malicious functions are not downloaded and protected information is not lost.
• D. A review of known configuration, and the absence of other configuration details, of cloud-hosted services in relation to best practices, industry standards, and compliance models to ensure misconfigurations, issues, and vulnerabilities are understood and highlighted.