Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

Match each Zero Trust Architecture (ZTA) logical component defined in NIST SP 800-207 to its primary operational responsibility.

  • Policy Engine (PE)Evaluates enterprise trust policies and contextual signals to make the ultimate decision to grant or deny resource access.
  • Policy Administrator (PA)Operates within the control plane to issue session credentials, configure communication paths, and signal gateways.
  • Policy Enforcement Point (PEP)Resides in the data plane to actively intercept, enable, monitor, or terminate connection sessions between subjects and resources.

Answer

The Policy Engine is responsible for evaluation and authorization decisions; the Policy Administrator handles control plane management and session credential signaling; the Policy Enforcement Point actively enforces access controls directly within the data plane.
According to NIST SP 800-207 Zero Trust Architecture, the Policy Engine handles the decision logic, the Policy Administrator handles control plane orchestrations and session keys, and the Policy Enforcement Point performs data plane enforcement directly on connections.

Step-by-Step Solution

1
Identify the core decision-making entity within the control plane.
The Policy Engine evaluates context, identity, and posture against trust rules to grant or deny access.
Zero Trust separates policy decision-making from policy enforcement mechanisms.
2
Determine which component translates policy decisions into control plane commands.
The Policy Administrator receives the decision from the Policy Engine and communicates with enforcement points to initiate or terminate communication channels.
The Policy Administrator serves as the controller orchestrating session setup and credential issuance.
3
Identify the data plane component interacting directly with network connections.
The Policy Enforcement Point monitors and filters data traffic, enabling or tearing down access sessions.
Enforcement must happen directly at the boundary of the requested resource or workload.

Key Concept

Logical Architecture of Zero Trust (NIST SP 800-207 Control and Data Planes)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic