Question

Difficulty: HardZero Trust Architecture Principles

A security architect is establishing control and data plane boundaries for a microsegmented enterprise network undergoing transition to a Zero Trust Architecture (ZTA). Match each logical Zero Trust component with its corresponding operational role during access evaluations.

  • Policy Engine (PE)Evaluates subject credentials, context, and enterprise security policies to make the ultimate decision to grant or deny resource access.
  • Policy Administrator (PA)Issues commands to establish or terminate communication paths between the subject and resource once an authorization decision is made.
  • Policy Enforcement Point (PEP)Intercepts incoming connection requests, monitors session traffic, and applies policy decisions directly to data plane communication channels.

Answer

The Policy Engine evaluates policies to make access decisions; the Policy Administrator communicates commands to establish/terminate communication channels; and the Policy Enforcement Point directly intercepts traffic and enforces policies at the data plane.
The Policy Engine evaluates context and policy rules to output access decisions. The Policy Administrator receives those decisions and manages credentials or signaling to setup/tear down communication paths. The Policy Enforcement Point intercepts connections directly to enforce policy controls on active network sessions.

Step-by-Step Solution

1
Identify the primary decision-making core of Zero Trust Architecture.
Recognize that the Policy Engine (PE) compares access requests against defined security policies to make grant/deny decisions.
Separation of control plane logic requires a centralized decision authority.
2
Identify the component responsible for signaling and connection management.
Recognize that the Policy Administrator (PA) executes PE decisions by instructing the control plane to open or close sessions.
The PA acts as the mediator between logical decisions and physical connection establishment.
3
Identify the data plane component handling direct traffic flow.
Recognize that the Policy Enforcement Point (PEP) resides on the data plane to physically allow, monitor, or block traffic.
PEPs act as gatekeepers directly in the flow of traffic.

Key Concept

Zero Trust Control Plane vs. Data Plane Architecture Components (NIST SP 800-207)
Rate this question