A security architect is establishing control and data plane boundaries for a microsegmented enterprise network undergoing transition to a Zero Trust Architecture (ZTA). Match each logical Zero Trust component with its corresponding operational role during access evaluations.
- Policy Engine (PE)Evaluates subject credentials, context, and enterprise security policies to make the ultimate decision to grant or deny resource access.
- Policy Administrator (PA)Issues commands to establish or terminate communication paths between the subject and resource once an authorization decision is made.
- Policy Enforcement Point (PEP)Intercepts incoming connection requests, monitors session traffic, and applies policy decisions directly to data plane communication channels.
Answer
The Policy Engine evaluates policies to make access decisions; the Policy Administrator communicates commands to establish/terminate communication channels; and the Policy Enforcement Point directly intercepts traffic and enforces policies at the data plane.
The Policy Engine evaluates context and policy rules to output access decisions. The Policy Administrator receives those decisions and manages credentials or signaling to setup/tear down communication paths. The Policy Enforcement Point intercepts connections directly to enforce policy controls on active network sessions.
Step-by-Step Solution
Key Concept
Zero Trust Control Plane vs. Data Plane Architecture Components (NIST SP 800-207)