A. Only if the risk score is high.

B. For all traffic from the initiating source.

C. For every access request.

D. For authorized users only.

A. Conditionally decide which access request is sent to a decoy service, not the real destination workload, thus allowing security teams insight into questionable activity.

B. Create various policy tiers, including several quarantine VLANs.

C. Engage in double-extortion negotiations.

D. Rethink its security posture, leveraging local breakouts from branch sites so that user traffic is filtered through a secure web gateway.

A. Interoperability issues between IPSec standards like IKEv1 and IKEv2.

B. Hairpinning cloud application traffic through a data center bottleneck.

C. A split tunnel VPN where you break out traffic destined for certain IP addresses to go direct.

D. VPN vendors throttle network traffic on the overlay by default to reduce overhead on the VPN headend.

A. Delivering connectivity, regardless of network or location, but only for authorized and compliant requests.

B. By connecting an initiator to a cloud network-gateway edge and then routing the user traffic over internal networks.

C. Ensuring that a user is correctly authorized at the application.

D. Layering in IP-level ACLs, which can require thousands of rules for modern web applications that are constantly adding new source IPs.

A. No.

B. Yes.

A. Allow direct access for connections from enterprise-managed devices and enforce authorization for unmanaged devices, on-site or remote.

B. Direct access to internal applications must never be allowed. Furthermore, internal applications should never be exposed to any untrusted initiator and thus must be dark. Only authorized users can connect.

C. Only allow connections via a secure point-to-point VPN connection.

D. Allow direct access for on-site initiators and enforce authorization for remote connections.

A. An assessment of all things related to the current connection, previous context, and considered on an ongoing basis for future requests, thus allowing for unique and dynamic changes in the consideration of risk.

B. Universal control across the entire enterprise. Once assessed, risk applies to all traffic from that enterprise.

C. An ongoing process to verify publicly known bad actor IP addresses.

D. A non-recurring process to determine how to treat requests from a specific initiator for the next 30 days.

A. Leverage the lowest-latency path, which typically involves service chaining to send traffic to a specialized branch where a stack of firewalls is hosted on a rack.

B. Leverage tremendous cost savings, since TLS/SSL connections have a per-packet premium cost associated with processing them.

C. Only view the metadata of a connection, such as who is calling and where they are calling.

D. Optimize their throughput.