A telemedicine organization is updating its infrastructure to align with Zero Trust Architecture (ZTA) principles for remote radiologists querying patient imaging databases hosted across hybrid cloud environments. The lead security architect mandates that access decisions must continuously evaluate user identity, device compliance, and real-time risk context, while separate proxy gateways enforce those authorization decisions at the resource boundary. Which of the following architectural implementations best satisfies this requirement?
- Establishing a centralized Policy Decision Point (PDP) to continuously evaluate contextual trust signals and direct dedicated Policy Enforcement Points (PEPs) to grant or deny access per requestAnswer
- BConfiguring an enterprise SSL VPN gateway that authenticates the user upon connection and grants implicit access to all internal database subnets for the active session duration
- CEnforcing multi-factor authentication at initial portal login to automatically assign permanent database access permissions without re-evaluating session state
- DDeploying stateful edge firewalls to filter inbound traffic at the perimeter while allowing unmonitored East-West communication between internal cloud database servers
Answer
Establishing a centralized Policy Decision Point (PDP) to continuously evaluate contextual trust signals and direct dedicated Policy Enforcement Points (PEPs) to grant or deny access per request.
Zero Trust Architecture explicitly separates control plane functions from data plane functions. The Policy Decision Point (PDP) evaluates policy, device posture, identity context, and threat intelligence to make dynamic access decisions. It then instructs the Policy Enforcement Point (PEP) situated inline near the target resource to allow, deny, or terminate specific connection sessions.
Step-by-Step Solution
Key Concept
Decoupling Policy Decision Points (PDP) from Policy Enforcement Points (PEP) in Zero Trust Architecture