QuestionQ19

Identify Network Access Control and Security Features

In a corporate network that follows Zero Trust best practices, a security team detects unusual activity from a device that was previously authenticated and authorized.

What should the team do next to protect the network’s security?

  • A Increase the device’s access privileges to monitor more closely.
  • B Ignore the activity since the device was already authenticated.
  • C Reduce the device’s privileges or quarantine it for further investigation.
Explanation

Zero Trust requires continuous evaluation of device state and observable behavior, rather than relying on an earlier authorization decision. When activity is suspicious, reducing access to least privilege or quarantining the device contains possible compromise while investigation proceeds.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!