Free Zero Trust Architecture and Secure Connectivity practice questions
10 free SY0-801 questions on Zero Trust Architecture and Secure Connectivity, each with a full explanation — no account needed. This section sits in the Security Architecture part of the exam. Answer every question to see your score, then read the lessons below for anything you missed.
In a company's access design, an access proxy receives each user's request for an application, asks a separate service whether to allow it, and then opens, limits or refuses the connection. Which Zero Trust role does the access proxy play?
The policy enforcement point sits in the path between the requester and the resource and carries out the answer it receives. The separate service that evaluates each request against policy is the policy decision point, while the identity provider and device management only supply signals to that decision.
An attacker uses a phishing proxy to relay a finance manager's password and one-time code, then signs in to the payment approval console. Which policy change would BEST stop this attack?
Phishing-resistant methods such as passkeys and FIDO2 security keys bind the login to the real site, so a relay proxy can't reuse them. Push approvals can still be approved by a tired user, a password change doesn't stop a live relay, and trusting the office IP range grants access by network location, which Zero Trust rejects.
A security architect worries that malware on a laptop could make the management agent report that the device is healthy when it isn't. Which capability counters this by having hardware measure each boot stage and sign the results?
Device health attestation uses a TPM to measure each stage of the boot process and sign the results, so malware can't simply report that everything is fine. A device certificate proves which device is asking rather than whether it is healthy, and a NAC check at join time is a one-time posture snapshot.
Each morning, a company's NAC checks a laptop's posture when it joins the network. An hour after one check, the laptop's EDR agent stops running, yet the laptop keeps reaching HR data for the rest of the day. Which change BEST closes this gap?
Zero Trust feeds device compliance into every request for the whole session, so a stopped EDR agent changes the next access decision. A second NAC check or MFA at first sign-in are still point-in-time checks, and a separate VLAN grants access by network location rather than by device health.
An administrator is reviewing four proposed conditional access rules. Which rule is MOST consistent with Zero Trust?
Using location as one risk signal, such as blocking countries where no staff work, narrows access and is reasonable. Skipping MFA on the office network, trusting VPN-connected devices and granting servers access because of their VLAN all widen trust because of where traffic comes from, which is the perimeter thinking Zero Trust replaces.
A network team links two data centers with a GRE tunnel and tells management that traffic between the sites is now protected from eavesdropping. What is wrong with this claim?
Tunneling is encapsulation, and GRE carries packets across a network with no encryption at all, solving a routing problem rather than a confidentiality one. A VPN adds encryption and authentication to the tunnel, so protecting the contents needs IPsec or another encrypted tunnel.
A company is opening a branch office whose 40 users must reach headquarters servers all day without installing or starting any VPN software. Which design fits BEST?
A site-to-site VPN links two networks through gateways at each end, stays up permanently and needs no software on users' devices, so branch traffic to headquarters subnets is simply routed into it. Remote access clients and clientless portals both work per user, which the requirement rules out.
Remote laptops miss patches and Group Policy updates because users rarely start the VPN, and some users switch it off to stream video. Which solution BEST addresses both problems?
Always-on VPN connects automatically, can't be turned off by the user, and its device tunnel comes up before logon so laptops receive policy and patches. Split tunneling eases video traffic but does nothing for laptops that never connect, and a clientless portal only publishes web applications to a browser.
A VPN concentrator uses local accounts that administrators create by hand. A terminated employee connects successfully a week after leaving. Which change BEST prevents this?
Tying remote access to the central directory through RADIUS, LDAP or SAML means disabling the departed employee's directory account ends VPN access at the same moment. Local VPN accounts are the ones that survive a departure, and password rotation, a protocol change or shorter sessions don't remove the account.
Two technicians from a payroll vendor need HTTPS access to one internal server through the company's VPN for the six months of their contract. Which setup BEST follows least privilege?
Individual accounts tie each action to one person, an expiry date matching the contract removes access when the work ends, and a per-group rule limits the vendor to one server and port. A shared account loses accountability even when it is scoped, and full network access with monitoring or reviews gives far more reach than the job needs.
Study this section
Every lesson that covers Zero Trust Architecture and Secure Connectivity on the SY0-801 exam.