An enterprise security architect is categorizing control plane and data plane functional duties during a Zero Trust Architecture (ZTA) migration. Match each Zero Trust architecture component on the left with its specific operational responsibility on the right.
- Policy Engine (PE)Evaluates access requests against enterprise policy rules and trust algorithms to render the ultimate decision to grant or deny access.
- Policy Administrator (PA)Executes control plane signals to issue session tokens or signal data-plane components to establish or terminate communication paths.
- Policy Enforcement Point (PEP)Operates at the data plane to intercept, inspect, and gate communication traffic between subjects and enterprise resources.
- Threat Intelligence SystemFeeds external vulnerability indicators, attack signatures, and dynamic risk data into the trust calculation engine.
Answer
The Policy Engine renders access authorization decisions; the Policy Administrator commands control plane session establishment or teardown; the Policy Enforcement Point gates data plane traffic; and the Threat Intelligence System supplies contextual threat data to dynamic trust scoring processes.
In Zero Trust Architecture (NIST SP 800-207), the control plane is split into evaluation logic (Policy Engine) and control execution (Policy Administrator), which together make up the Policy Decision Point (PDP). The Policy Enforcement Point (PEP) resides in the data plane to directly gate resource access. External contextual providers, such as Threat Intelligence Systems, supply real-time attack data to inform dynamic trust decisions.
Step-by-Step Solution
Key Concept
Zero Trust Control Plane vs. Data Plane Component Functions (NIST SP 800-207)