Zero Trust and IAM practice questions
Fifteen free Zero Trust and identity and access management (IAM) practice questions with explained answers. Zero Trust is a security model that grants no implicit trust based on network location and verifies every request using identity, device health and context. IAM covers how accounts are provisioned, authenticated, authorized and reviewed. Both are tested in Security+ SY0-801.
How to use these questions
- Answer before reading the explanation, then check why each wrong option fails.
- Note the constraint word in each stem: “least”, “first”, “most”, or the specific control type being asked for.
- Separate authentication (who are you), authorization (what may you do) and accounting (what did you do).
- The topic guide Zero Trust explained covers the principles and the policy decision and enforcement split.
Warm-up: principles and access models
Question 1. Which statement best describes the Zero Trust model?
- A. Users on the internal network are trusted and external users are verified
- B. No request is trusted by default because of its network location; each is verified
- C. Strong passwords are required for all accounts
- D. All network traffic is encrypted end to end
Show answer
Answer: B
Zero Trust removes implicit trust: every request is verified using identity, device state and context, wherever it originates. Trusting everything behind the firewall is the perimeter model Zero Trust replaces. Stronger passwords alone do not change how trust is granted. Encrypting traffic is one useful control but does not define the model.
Question 2. Administrators currently hold permanent domain admin rights. A new design gives them standard accounts and lets them request admin rights for two hours when a task needs them. Which concept is this?
- A. Mandatory access control
- B. Discretionary access control
- C. Rule-based access control
- D. Just-in-time access
Show answer
Answer: D
Elevating rights only when needed and for a limited time is just-in-time access, an application of least privilege. Mandatory access control assigns access by labels set by the system. Discretionary access control lets owners grant access. Rule-based access control applies fixed rules to every request and does not describe temporary elevation.
Question 3. When a person joins the finance department, the help desk adds the account to the Finance Staff group, which already holds all permissions the job requires. Which access control model is in use?
- A. Role-based access control
- B. Mandatory access control
- C. Discretionary access control
- D. Attribute-based access control
Show answer
Answer: A
Permissions are tied to a job function and assigned to users through membership, which is role-based access control. Mandatory access control uses classification labels. Discretionary access control lets resource owners decide. Attribute-based access control evaluates attributes of the user, the resource and the environment, which is not described.
Question 4. Employees of a partner company must sign in to the company portal with the credentials of their own employer, with no separate accounts created here. Which identity concept enables this?
- A. Local account provisioning
- B. Identity proofing
- C. Federation
- D. Access attestation
Show answer
Answer: C
Federation lets one organization trust identities asserted by another, so partner users authenticate at home and are accepted here. Provisioning creates local accounts, which the requirement rules out. Identity proofing verifies who a person is when the account is created. Attestation here would mean a review of access, which is not the goal.
Question 5. Last quarter, an audit found enabled accounts of staff who had left the company months earlier. Which process was missed?
- A. Provisioning
- B. Deprovisioning
- C. Identity proofing
- D. Single sign-on
Show answer
Answer: B
Deprovisioning disables or removes accounts and access when someone leaves, and it should be triggered by the HR departure. Provisioning creates accounts. Identity proofing happens at onboarding, before credentials are issued. Single sign-on reduces password prompts and has no effect on leftover accounts.
Scenarios: IAM controls in context
Question 6. An employee moved from accounts payable to marketing two years ago and still holds payment approval rights from the old job. Which recurring control would be MOST likely to find and fix this?
- A. Periodic access reviews
- B. Longer minimum password length
- C. Multifactor authentication
- D. A stricter account lockout threshold
Show answer
Answer: A
This is privilege creep, found by periodic access reviews (recertification) where managers confirm that each person’s rights match their current role. Longer passwords do not change which rights exist. MFA protects authentication but not excessive permissions. Account lockout limits guessing attacks only.
Question 7. A contractor connects an unmanaged laptop to the corporate Wi-Fi. Under a Zero Trust approach, what should happen before the laptop reaches internal applications?
- A. It receives full access, because it joined the corporate network
- B. It is placed in the user VLAN without any checks
- C. The contractor signs an acceptable use form and gets full access
- D. Its posture is assessed, and access is denied or limited if it fails
Show answer
Answer: D
Verifying explicitly includes device health: the laptop should be assessed against posture requirements such as patch level and endpoint protection, and be denied or limited if it fails. Trusting any device that has valid Wi-Fi credentials relies on location. An unchanged VLAN offers no check. Accepting a signed form checks nothing technical.
Question 8. A Windows domain application runs on three servers and must authenticate to a database. Administrators want the password managed automatically, with no human ever knowing it. What should be used?
- A. A shared user account with a long password
- B. A local administrator account on each server
- C. A group Managed Service Account
- D. An anonymous database login
Show answer
Answer: C
A group Managed Service Account (gMSA) lets multiple servers use one service identity whose password is generated and rotated by the domain. A shared user account has a password people know and rarely change. A local administrator account is excessive and not shared across servers. An anonymous bind provides no authentication.
Question 9. An MFA service outage locks every administrator out of the cloud tenant. To prevent this in future, which design is recommended?
- A. Disable MFA for all administrators
- B. Create monitored emergency access accounts that are excluded from Conditional Access policies that block or restrict sign-in
- C. Share one admin password and use it daily
- D. Have administrators phone the help desk to reset access
Show answer
Answer: B
Microsoft guidance for emergency access (break-glass) accounts: create two or more cloud-only accounts, exclude them from Conditional Access policies that block or restrict sign-in, store the credentials securely, and monitor sign-in and audit logs with alerts whenever they are used. Disabling MFA for every administrator removes a key control. A shared password used daily is neither protected nor accountable. Routing admins to the help desk creates a dependency on a service that may be down.
Question 10. A defense contractor labels documents Confidential, Secret and Top Secret. Users receive clearances, and the system alone decides access by comparing the two. Users cannot change permissions on documents they create. Which model is this?
- A. Mandatory access control
- B. Discretionary access control
- C. Role-based access control
- D. Attribute-based access control
Show answer
Answer: A
Access decided by the system from labels and clearances, without owner discretion, is mandatory access control. Discretionary access control lets owners share what they own. Role-based access control keys on job roles, not classification labels. Attribute-based access control evaluates attributes of the user, resource and environment rather than fixed labels and clearances.
Edge cases and traps
Question 11. Microsoft describes Zero Trust with three guiding principles. Which option lists them?
- A. Encrypt everything, segment the network, monitor continuously
- B. Trust but verify, defend the perimeter, patch quickly
- C. Authenticate once, authorize once, audit annually
- D. Verify explicitly, use least privilege access, assume breach
Show answer
Answer: D
Microsoft’s Zero Trust guidance names three principles: verify explicitly, use least privilege access, and assume breach. The other lists mix in supporting measures such as encryption, segmentation and monitoring, or describe the older perimeter mindset that Zero Trust replaces.
Question 12. A user passed MFA at 08:00. At noon a stolen session token was used from a different country, and the application accepted it. Which change best fits the Zero Trust principle of verifying explicitly?
- A. Extend the session lifetime to 24 hours
- B. Increase the password history requirement
- C. Evaluate risk signals continuously and require re-authentication on changes
- D. Rely on the 08:00 authentication for the whole day
Show answer
Answer: C
Verifying explicitly means evaluating signals such as location, device and risk continuously, so a session that suddenly changes context is re-challenged or terminated. A longer session lifetime gives a stolen token more time. A larger password history affects password reuse only. Relying on a one-time check at the start repeats the flaw.
Question 13. A company hires remote staff it has never met. Before issuing credentials, HR validates a government ID and matches it to a live video check. Which IAM process is this?
- A. Identity proofing
- B. Authentication
- C. Authorization
- D. Accounting
Show answer
Answer: A
Verifying that a person is who they claim to be before an account and credentials are issued is identity proofing. Authentication checks credentials already issued. Authorization decides what an identified user may do. Accounting records what the user did.
Question 14. A mobile app needs to learn who the signed-in user is. The identity provider must return the user's identity as a signed JSON Web Token on top of OAuth 2.0 authorization. Which protocol is designed for this?
- A. OAuth 2.0 alone
- B. OpenID Connect
- C. Kerberos
- D. RADIUS
Show answer
Answer: B
OpenID Connect is an identity layer on top of OAuth 2.0 and returns an ID token (a JWT) describing the authenticated user. OAuth 2.0 alone delegates authorization and does not define user identity. Kerberos uses tickets inside a domain, not JWTs. RADIUS authenticates network access requests and does not issue JWTs.
Question 15. After phishing compromised a sales laptop, an attacker used it to reach file servers across the whole network. Which change best applies the Zero Trust principle of assuming breach?
- A. Add a stronger firewall at the network edge
- B. Extend the password expiry period
- C. Segment the network and grant access per application
- D. Add a legal warning banner at login
Show answer
Answer: C
Assuming breach means limiting the blast radius, so segmenting the network and granting per-application access stops one compromised endpoint from reaching everything. A stronger perimeter firewall still trusts what is inside. Longer password expiry does nothing against an already compromised device. A banner is a deterrent and does not limit access.
Where to go next
Read the topic guide Zero Trust explained, then practise security controls and risk calculation. For a longer set, take the free 20-question SY0-801 practice test. Wording traps are covered in multiple-choice exam tips.