Question

Difficulty: MediumZero Trust Architecture Principles

Match each core Zero Trust Architecture (ZTA) functional component to its primary operational responsibility within an enterprise security infrastructure.

  • Policy Engine (PE)Evaluates enterprise security policies and contextual dynamic risk signals to render the ultimate decision to grant, deny, or revoke resource access.
  • Policy Administrator (PA)Issues control plane signaling commands to configure communication paths and manages session credentials or tokens following an approved access decision.
  • Policy Enforcement Point (PEP)Intercepts session traffic, inspects communication requests, and directly allows or severs data plane connections between subjects and enterprise resources.
  • Continuous Diagnostics and Mitigation (CDM)Gathers asset health posture, configuration compliance baselines, and patch telemetry to feed real-time contextual state into evaluation engines.

Answer

Policy Engine pairs with evaluating security policies and context to render access decisions. Policy Administrator pairs with issuing control commands and managing session tokens. Policy Enforcement Point pairs with intercepting traffic and enforcing data plane connections. Continuous Diagnostics and Mitigation pairs with gathering asset posture and vulnerability telemetry.
Zero Trust Architecture explicitly separates control plane operations from data plane execution. The Policy Engine determines access authorization, the Policy Administrator handles control signaling and session token distribution, the Policy Enforcement Point gates data plane traffic, and Continuous Diagnostics and Mitigation feeds real-time posture intelligence to inform ongoing access evaluations.

Step-by-Step Solution

1
Differentiate between policy decision logic and control plane session management.
Identify that the Policy Engine evaluates policy rules to make the access decision, while the Policy Administrator acts on that decision to manage session controls.
Decoupling decision logic (PE) from execution signals (PA) ensures strict separation of duties within the control plane.
2
Identify the operational boundary component handling active user traffic.
Associate the Policy Enforcement Point with direct data plane traffic inspection, gating, and session termination.
The PEP acts as the perimeter-less gatekeeper directly between the requester and enterprise workload.
3
Identify the supporting telemetry system providing contextual state data.
Associate Continuous Diagnostics and Mitigation with tracking endpoint compliance, patch levels, and device integrity.
Zero Trust demands explicit, continuous verification supported by ongoing threat and posture monitoring systems.

Key Concept

Zero Trust Architecture Functional Component Roles (NIST SP 800-207)
Estimated Time:1m 30s
Rate this question