Question

Difficulty: HardZero Trust Architecture Principles

An enterprise security architect is categorizing control plane and data plane functional duties during a Zero Trust Architecture (ZTA) migration. Match each Zero Trust architecture component on the left with its specific operational responsibility on the right.

  • Policy Engine (PE)Evaluates access requests against enterprise policy rules and trust algorithms to render the ultimate decision to grant or deny access.
  • Policy Administrator (PA)Executes control plane signals to issue session tokens or signal data-plane components to establish or terminate communication paths.
  • Policy Enforcement Point (PEP)Operates at the data plane to intercept, inspect, and gate communication traffic between subjects and enterprise resources.
  • Threat Intelligence SystemFeeds external vulnerability indicators, attack signatures, and dynamic risk data into the trust calculation engine.

Answer

The Policy Engine renders access authorization decisions; the Policy Administrator commands control plane session establishment or teardown; the Policy Enforcement Point gates data plane traffic; and the Threat Intelligence System supplies contextual threat data to dynamic trust scoring processes.
In Zero Trust Architecture (NIST SP 800-207), the control plane is split into evaluation logic (Policy Engine) and control execution (Policy Administrator), which together make up the Policy Decision Point (PDP). The Policy Enforcement Point (PEP) resides in the data plane to directly gate resource access. External contextual providers, such as Threat Intelligence Systems, supply real-time attack data to inform dynamic trust decisions.

Step-by-Step Solution

1
Differentiate between Policy Decision Point (PDP) components and Policy Enforcement Point (PEP) locations.
Identified the Policy Engine and Policy Administrator as core PDP components in the control plane, while the PEP functions strictly within the data plane boundary.
ZTA relies on a clear operational separation between control plane decision logic and data plane traffic enforcement.
2
Distinguish between the decision logic (PE) and the execution logic (PA) within the PDP.
Matched the Policy Engine to policy calculation and access decision rendering, and the Policy Administrator to signaling the PEP to open or close session channels.
The PE evaluates contextual inputs against trust algorithms, whereas the PA communicates decision outcomes to enforcement gates.
3
Map supporting data sources to their external telemetry role.
Associated the Threat Intelligence System with providing real-time external threat feeds and dynamic risk context.
Continuous authorization relies on contextual data sources outside standard static identity attributes.

Key Concept

Zero Trust Control Plane vs. Data Plane Component Functions (NIST SP 800-207)
Rate this question