CSA Certificate of Competence in Zero Trust (CCZT)

Which core principle of Zero Trust architecture requires that no user, device, or network segment be inherently trusted, regardless of its physical or logical location?

• AImplicit trust within the perimeter
• BNever trust, always verify
• CTrust but verify at login
• DPerimeter-based defense in depth

According to NIST SP 800-207, which component of a Zero Trust Architecture is responsible for making the ultimate access decision by evaluating policy and external data sources?

• APolicy Enforcement Point (PEP)
• BPolicy Administrator (PA)
• CPolicy Engine (PE)
• DControl Plane Gateway

In the NIST SP 800-207 Zero Trust Architecture model, which component sits between the subject and the resource and enables, monitors, and terminates connections based on directives from the Policy Administrator?

• AIdentity Provider (IdP)
• BSecurity Information and Event Management (SIEM)
• CPolicy Enforcement Point (PEP)
• DCertificate Authority (CA)

Which of the following is listed as one of the seven core tenets of Zero Trust in NIST SP 800-207?

• AAll network traffic within the trusted zone is implicitly authorized
• BAll data sources and computing services are considered resources
• CVPN endpoints establish the boundary for Zero Trust enforcement
• DHardware firewalls define the perimeter for policy enforcement

The CISA Zero Trust Maturity Model version 2.0 (April 2023) defines five pillars. Which set correctly lists all five pillars?

• AIdentity, Devices, Networks, Data, Endpoints
• BIdentity, Devices, Networks/Environments, Applications and Workloads, Data
• CUsers, Applications, Cloud, Data, Automation
• DPerimeter, Identity, Devices, Workloads, Analytics

Which three cross-cutting capabilities run through all five pillars of the CISA Zero Trust Maturity Model?

• AEncryption, Monitoring, Incident Response
• BVisibility and Analytics, Automation and Orchestration, Governance
• CAuthentication, Authorization, Accounting
• DIdentity Proofing, Device Management, Network Segmentation

In the CISA Zero Trust Maturity Model, what are the four stages of maturity through which each pillar evolves?

• ABaseline, Developing, Capable, Optimized
• BTraditional, Initial, Advanced, Optimal
• CLevel 1, Level 2, Level 3, Level 4
• DAd Hoc, Defined, Managed, Continuous

Which foundational concept distinguishes Software-Defined Perimeter (SDP) from traditional network perimeter security?

• ASDP relies on stateful firewall rules at the network edge
• BSDP uses an authenticate-before-connect model that hides resources until identity is veri…
• CSDP replaces identity with IP-address-based allow lists
• DSDP creates a static encrypted tunnel for all corporate users

In the CSA Software-Defined Perimeter architecture, which component acts as the Policy Decision Point that authenticates initiating hosts and authorizes their access to specific accepting hosts?

• ASDP Accepting Host (AH)
• BSDP Initiating Host (IH)
• CSDP Controller
• DSDP Certificate Authority

What is the primary purpose of the Single Packet Authorization (SPA) mechanism used in SDP deployments?

• ATo encrypt all data-in-transit between client and server
• BTo authenticate the client before any network port is opened on the accepting host
• CTo replace TLS for application-layer security
• DTo synchronize session keys between the SDP Controller and SIEM

An organization is migrating from a VPN-centric remote access model to Zero Trust Network Access (ZTNA). Which capability is the PRIMARY security improvement ZTNA provides over traditional VPN?

• AFaster data transfer speeds for remote workers
• BPer-application access rather than broad network-level access
• CElimination of multi-factor authentication requirements
• DAutomatic trust for managed corporate devices on the internal network

Which ZTNA deployment model positions the broker service at the application edge, so traffic does not traverse the enterprise network, and is ideal for cloud-hosted applications?

• AAgent-based client-initiated ZTNA with on-premises broker
• BService-initiated ZTNA with cloud-delivered connector
• CHardware appliance ZTNA with inline inspection
• DSplit-tunnel VPN with identity-aware proxy

According to NIST SP 800-207, which threat scenario is the Zero Trust Architecture specifically designed to mitigate through dynamic, per-request policy evaluation?

• APhysical theft of server hardware
• BInsider threat and compromised credentials moving laterally
• CDistributed denial-of-service attacks on public endpoints
• DSupply chain compromise of hardware firmware

In Zero Trust planning, what is the PRIMARY reason an organization should identify and classify its 'protect surface' before designing access policies?

• ATo determine the number of firewall licenses required
• BTo focus Zero Trust controls on the most critical data, assets, applications, and services
• CTo replace the existing IP addressing scheme
• DTo comply with ISO 27001 documentation requirements

Which of the following BEST describes 'microsegmentation' as used in Zero Trust implementations?

• ADividing the physical data center into separate buildings
• BCreating granular network security zones down to the workload or application level to pre…
• CSplitting VLANs by department at the campus switch level
• DDeploying separate DNS servers for each business unit

The DoD Zero Trust Strategy (released October 2022) targets how many Zero Trust capabilities across seven pillars, and by what year must Target Level ZT be achieved?

• A30 capabilities, 2025
• B45 capabilities, 2027
• C100 capabilities, 2030
• D60 capabilities, 2032

Which DoD Zero Trust pillar aligns with ensuring every device used to access DoD resources has a known, verified, and continuously monitored security posture?

• AUsers
• BAutomation and Orchestration
• CDevices
• DVisibility and Analytics

In Zero Trust planning, what is the recommended sequence for developing a Zero Trust Architecture according to the CSA Zero Trust Planning guide?

• ADeploy technology first, then define policy, then identify assets
• BIdentify the protect surface, map transaction flows, build the ZT architecture, create po…
• CPurchase ZTNA products, configure VLANs, then apply identity policies
• DConduct penetration testing first, then redesign the network perimeter

Which concept describes Zero Trust's approach to access where permissions are granted only for what a user or service strictly needs, for the minimum time required?

• ASeparation of duties
• BLeast privilege access
• CMandatory access control
• DRole explosion management

Which identity-related control is considered a MINIMUM baseline requirement before an organization can claim to be operating a Zero Trust environment?

• AHardware security keys for every user
• BMulti-factor authentication (MFA) for all users and privileged accounts
• CBiometric authentication for physical access only
• DShared service accounts with rotating passwords

In Zero Trust, 'continuous verification' means that access decisions are re-evaluated based on which set of signals?

• AOnly at login time based on username and password
• BPeriodically every 24 hours based on last-known device state
• CContinuously based on user identity, device health, location, behavior, and resource sens…
• DOnly when the user changes roles or departments

Which term describes the Zero Trust design approach where each network segment, application, or workload is protected by its own dedicated micro-perimeter rather than a single large perimeter?

• ADefense in breadth
• BMacro-segmentation
• CMicro-perimeter
• DFlat network topology

According to the CSA Introduction to Zero Trust, which approach does Zero Trust use to handle east-west traffic within a data center?

• AAll east-west traffic is trusted because it is already inside the perimeter
• BEast-west traffic is inspected and controlled using the same Zero Trust policies as north…
• CEast-west traffic is encrypted but not inspected
• DEast-west traffic is blocked entirely to prevent all lateral movement

An organization is in the earliest stage of Zero Trust maturity according to CISA ZTMM. Which characteristic BEST describes its current state?

• AAutomated, just-in-time access with full behavioral analytics
• BManual configurations, siloed identity stores, limited visibility, and reliance on static…
• CDynamic policy with integrated threat intelligence and orchestrated response
• DContinuous compliance monitoring across all five pillars with no manual processes

Which Zero Trust Architecture deployment variation described in NIST SP 800-207 uses an enhanced identity governance approach where strong identity is the primary policy driver and network location plays a minor role?

• AMicro-segmentation using software-defined networking
• BNetwork infrastructure and software-defined perimeters
• CDevice agent and gateway-based ZTA
• DIdentity-based ZTA with enterprise-managed identity providers

What is the key difference between implicit trust and explicit verification in a Zero Trust model?

• AImplicit trust uses passwords; explicit verification uses certificates
• BImplicit trust assumes safety based on location; explicit verification requires continuou…
• CImplicit trust is used for cloud apps; explicit verification is used for on-premises apps
• DImplicit trust applies to read-only operations; explicit verification applies to write op…

In a Zero Trust Architecture, which data-plane control is responsible for establishing encrypted, mutually authenticated sessions between subjects and resources after the Policy Administrator signals approval?

• ASecurity Orchestration, Automation, and Response (SOAR)
• BPolicy Enforcement Point (PEP) using mutual TLS
• CNetwork Access Control (NAC) using 802.1X
• DWeb Application Firewall (WAF) using TLS inspection

Which Zero Trust control strategy involves placing a security enforcement point as a reverse proxy in front of a specific application so that all user requests must pass through it before reaching the app?

• AInline DLP filtering
• BIdentity-aware proxy (application-level gateway)
• CTransparent bridging
• DIP spoofing prevention

Which of the following BEST describes the role of 'data' as a protect surface in a Zero Trust implementation?

• AData is only protected at rest using database encryption
• BData is the most critical protect surface — it must be discovered, classified, and protec…
• CData protection is handled exclusively by the cloud provider in shared responsibility
• DData is protected only when leaving the network through egress filtering

In NIST SP 800-207, what is the term for the logical component that represents a Zero Trust policy decision executed by the Policy Administrator to allow or deny an access request?

• ATrust algorithm output
• BAuthorization ticket
• CPolicy grant signal
• DAccess token

Which capability is described under the CISA ZTMM 'Visibility and Analytics' cross-cutting capability?

• AIssuing X.509 certificates to all managed devices
• BDeploying endpoint detection tools on every device
• CCollecting, correlating, and acting on telemetry from all pillars to detect anomalies and…
• DConfiguring firewall rules to block known malicious IP addresses

Which SDP deployment model is MOST appropriate for enabling cloud-to-cloud resource access between microservices running in different cloud environments?

• AClient-to-gateway with on-premises controller
• BServer-to-server (gateway-to-gateway) SDP deployment
• CClient-to-server with a hardware HSM authenticator
• DGateway-to-cloud with MPLS backbone

Which statement BEST describes the concept of 'assume breach' in Zero Trust?

• AOrganizations should delay security investments until a breach occurs
• BDesign security controls as if adversaries are already inside the environment, minimizing…
• CAssume all external traffic is malicious and block it by default
• DAssume all employees will eventually become malicious insiders

An enterprise wants to enforce Zero Trust for its legacy applications that cannot support modern identity protocols. Which approach is MOST consistent with Zero Trust principles?

• AExempt legacy apps from Zero Trust policies
• BPlace a Zero Trust-aware proxy or gateway in front of legacy apps to broker identity veri…
• CMigrate all users to a separate VLAN for legacy app access
• DIssue static shared credentials for legacy app access

Which term describes the strategy of granting access only at the moment it is needed and revoking it immediately after, as opposed to standing persistent access?

• AJust-in-time (JIT) access
• BRole-based access control (RBAC)
• CDiscretionary access control (DAC)
• DPersistent privileged access

In the CSA SDP Specification, what is the function of the 'Initiating Host' (IH)?

• ATo make access policy decisions and configure gateways
• BTo enforce network segmentation at the Layer 2 switch
• CTo authenticate to the SDP Controller and establish an encrypted connection to authorized…
• DTo issue digital certificates to all SDP components

Which NIST SP 800-207 concept refers to the collection and use of data from multiple sources — including CDM feeds, threat intel, activity logs, and device compliance — to inform the Policy Engine's access decision?

• ASecurity posture database
• BContinuous diagnostics and mitigation (CDM) stream
• CTrust algorithm inputs
• DIdentity governance audit trail

Which Zero Trust strategy is MOST effective for protecting against attackers who gain valid credentials through phishing?

• ABlocking all remote access by default
• BPhishing-resistant MFA combined with device trust and continuous behavioral monitoring
• CRequiring users to change passwords every 30 days
• DDeploying a spam filter to block phishing emails

In a Zero Trust Architecture, what does 'data plane' refer to, as distinguished from the 'control plane'?

• AThe physical cabling infrastructure of the network
• BThe component layer that makes and communicates access decisions
• CThe layer where actual resource communication occurs after policy decisions have been made
• DThe management console for configuring Zero Trust policies

Which zero trust implementation approach is BEST suited for an organization that has heavily adopted SaaS applications and needs to enforce consistent access policy without backhauling traffic to a corporate data center?

• AOn-premises hardware ZTNA appliances at HQ
• BSplit-tunnel VPN with SaaS traffic bypass
• CCloud-delivered Security Service Edge (SSE) with ZTNA, CASB, and SWG
• DIPsec site-to-site VPN mesh between all offices

According to NIST SP 800-207, which assumption about network traffic is fundamental to Zero Trust Architecture?

• ATraffic from the corporate LAN is inherently safe
• BRemote traffic is always more risky than internal traffic
• CNo network is inherently trusted; all traffic must be inspected and authenticated
• DEncrypted traffic should bypass inspection to protect user privacy

Which metric or signal is MOST directly used in a Zero Trust Architecture to determine the real-time risk posture of a device before granting access?

• AThe device's IP address and subnet membership
• BDevice compliance status including patch level, EDR health, and configuration compliance
• CThe user's employment start date
• DThe device's network interface card MAC address

What does the Zero Trust concept of 'network segmentation' at the application layer aim to prevent, compared to traditional VLAN-based segmentation?

• AIt prevents unauthorized Wi-Fi access to corporate networks
• BIt prevents east-west lateral movement between individual workloads, not just between net…
• CIt prevents all IPv6 traffic from traversing the enterprise network
• DIt prevents users from accessing the internet directly

Which term in Zero Trust planning describes the set of critical data, applications, assets, and services (DAAS) that an organization must protect with the strictest Zero Trust controls?

• AAttack surface
• BCrown jewels
• CProtect surface
• DTrust boundary

The DoD Zero Trust Strategy defines seven pillars. Which additional pillars does the DoD model include that are NOT present in the five CISA ZTMM pillars?

• ACloud and Endpoints
• BAutomation and Orchestration, and Visibility and Analytics
• CCompliance and Risk Management
• DZero Trust Architecture and Governance

What is the PRIMARY purpose of 'transaction flow mapping' in the Zero Trust planning methodology?

• ATo document financial transaction processing workflows for audit
• BTo understand how users, applications, and services access the protect surface so policie…
• CTo map VLAN configurations to physical switch ports
• DTo trace HTTP requests through load balancers for performance optimization