Examkin

Question

Difficulty: MediumIdentity and Access Management Architecture

A healthcare organization is updating its enterprise Identity and Access Management (IAM) architecture to support dynamic, fine-grained access control across decoupled microservices. The security team requires a centralized component that evaluates contextual attributes—such as user role, device posture, time of day, and resource sensitivity—against security policies to issue an authorization decision for each access request. Which architectural component directly performs this policy evaluation to determine whether access should be granted?

  1. Policy Decision Point (PDP)Answer
  2. B
    Policy Enforcement Point (PEP)
  3. C
    Identity Provider (IdP)
  4. D
    Perimeter Next-Generation Firewall (NGFW)

Answer

Policy Decision Point (PDP)
The Policy Decision Point (PDP) is the architectural entity in Attribute-Based Access Control (ABAC) and Zero Trust architectures responsible for receiving authorization requests, evaluating them against configured access policies and environmental attributes, and issuing a definitive permit or deny decision.

Step-by-Step Solution

1
Analyze the architectural requirements stated in the scenario.
The requirement calls for a component that evaluates access policies against context attributes to issue an authorization decision.
Decoupling policy evaluation from enforcement allows centralized management of fine-grained authorization rules.
2
Differentiate between XACML/ABAC architecture roles (PDP vs. PEP vs. IdP).
The Policy Decision Point (PDP) performs logic processing and rule evaluation, while the Policy Enforcement Point (PEP) intercepts and enforces the decision.
The question specifically asks for the component that evaluates policies and issues the decision.

Key Concept

Attribute-Based Access Control (ABAC) and Policy Decision Point (PDP) Architecture
Rate this question

Topics

Identity and Access Management Architecture

More questions from this topic