Certificate of Competence in Zero Trust (CCZT)

Last checked November 10, 2026 against the official Cloud Security Alliance exam page.

1. Question 1Foundational Zero Trust concepts

   A company relies on a hardened perimeter firewall. Once an employee connects to the office LAN, they can reach file servers, finance databases, and admin consoles without any further checks. Which zero trust principle is most directly violated by this design?

   1. AEncryption of data at rest on the file servers
   2. BRegular patching of operating system software on the file servers
   3. CImplicit trust given to requests from inside the network
   4. DSeparation of duties between finance staff and IT administrators
   Show answer and explanationHide answer

   Correct answer: C

   Zero trust removes implicit trust based on network location, so every request must be authenticated and authorized wherever it originates. Encryption at rest, patching, and separation of duties are sound controls, but the flaw in this scenario is that the LAN itself is treated as trusted.

2. Question 2Zero Trust architecture

   In NIST SP 800-207, which logical component is responsible for deciding whether a subject may access a resource?

   1. AIdentity provider that issues and stores user credentials for applications
   2. BPolicy Enforcement Point that opens and closes the data path
   3. CPolicy Administrator that sets up and tears down the communication path
   4. DPolicy Engine that weighs policy and trust signals per request
   Show answer and explanationHide answer

   Correct answer: D

   The Policy Engine is the decision component in NIST SP 800-207, using policy and trust signals to grant or deny access. The Policy Enforcement Point carries out decisions on the data path, the Policy Administrator establishes or ends the session, and an identity provider is a supporting source of identity data rather than one of the three logical components.

3. Question 3Software Defined Perimeter

   What is the primary role of the SDP controller in a software defined perimeter architecture?

   1. AIt authenticates hosts and tells accepting hosts which clients may connect
   2. BIt relays all application payload traffic between users and services
   3. CIt stores encrypted copies of every user's application passwords
   4. DIt replaces endpoint security agents so managed devices need no local software at all
   Show answer and explanationHide answer

   Correct answer: A

   In SDP the controller authenticates initiating and accepting hosts and tells each accepting host which clients are allowed to connect, while application data flows directly between the two hosts. The controller does not relay payloads, store passwords, or remove the need for endpoint security.

4. Question 4Zero Trust strategy

   A CISO wants to start a zero trust program next quarter. Which first step best aligns the strategy with the organization's goals?

   1. AReplace every firewall with ZTNA appliances during the current quarter
   2. BBuy one zero trust product that claims complete coverage of the whole estate
   3. CMap critical data and services to business goals, with executive sponsorship
   4. DStart with advanced micro-segmentation tooling before reviewing any assets
   Show answer and explanationHide answer

   Correct answer: C

   Aligning zero trust with business goals, starting from the most critical data and services, and securing executive sponsorship gives the program direction and funding. Replacing firewalls, buying a single product, or buying tooling before knowing the assets all skip the planning the strategy depends on.

5. Question 5Zero Trust planning

   During planning, a team finds several legacy applications that have no documented owner and no data classification. What should happen first?

   1. AAssign owners and classify the data, since policy decisions depend on both
   2. BGrant unrestricted access until classification is complete, to avoid outages
   3. CMigrate the applications to a new cloud platform before anything else
   4. DRemove the applications from scope permanently and stop reviewing them
   Show answer and explanationHide answer

   Correct answer: A

   Zero trust policies depend on knowing what a resource is, who is accountable for it, and how sensitive its data is, so ownership and classification come first. Unrestricted access, a migration, or permanent removal from scope either skip these steps or create new risk.