Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

An autonomous electric vehicle (EV) charging network operator is updating its management plane and edge gateway infrastructure to comply with NIST SP 800-207 Zero Trust Architecture (ZTA) principles. Match each Zero Trust logical component to its core operational responsibility within the enterprise architecture.

  • Policy Engine (PE)Evaluates access requests against enterprise security policies and dynamic risk algorithms to render an ultimate access decision.
  • Policy Administrator (PA)Translates policy decisions into control plane commands to generate session keys or instruct gatekeepers to establish or sever communication paths.
  • Policy Enforcement Point (PEP)Operates in the data plane to intercept, inspect, enable, and terminate active connection sessions between subjects and resources.
  • Continuous Diagnostics and Mitigation (CDM) SystemMonitors endpoint posture, configuration state, and system vulnerabilities to supply real-time contextual intelligence to the decision engine.

Answer

Policy Engine (PE) matches with evaluating access requests against policies and risk algorithms. Policy Administrator (PA) matches with translating decisions into control plane commands and session keys. Policy Enforcement Point (PEP) matches with operating in the data plane to intercept, inspect, enable, and terminate active connection sessions. Continuous Diagnostics and Mitigation (CDM) System matches with monitoring endpoint posture and vulnerability state for real-time contextual intelligence.
NIST SP 800-207 divides Zero Trust Architecture into distinct logical components across the control plane and data plane. The Policy Engine evaluates policy and telemetry to make access decisions. The Policy Administrator receives those decisions and commands Policy Enforcement Points to open, monitor, or close sessions. The Policy Enforcement Point acts as the inline barrier in the data plane to manage connection traffic. Continuous Diagnostics and Mitigation systems gather device state telemetry to provide the ongoing context necessary for dynamic trust evaluation.

Step-by-Step Solution

1
Differentiate between the Control Plane components (Policy Engine and Policy Administrator) and the Data Plane component (Policy Enforcement Point).
Identified the Policy Engine as the decision maker, the Policy Administrator as the control signal manager, and the Policy Enforcement Point as the inline data traffic gatekeeper.
Zero Trust Architecture enforces a strict functional separation between access decision logic and data path enforcement.
2
Identify the contextual support role of telemetry systems such as Continuous Diagnostics and Mitigation (CDM).
Mapped CDM to endpoint health state, vulnerability metrics, and continuous compliance monitoring.
Zero Trust dynamic access evaluations require real-time posture context rather than static perimeter trust assumptions.
3
Map each component to its exact functional description as specified in NIST SP 800-207.
Verified accurate component-to-responsibility pairings.
Ensures standard alignment with standard Zero Trust Architecture control plane and data plane models.

Key Concept

Zero Trust Architecture Control Plane vs. Data Plane Component Responsibilities
Estimated Time:1m 30s
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic