Examkin

Question

Difficulty: Very hardZero Trust Architecture Principles

An enterprise architecture team is designing a NIST SP 800-207 compliant Zero Trust solution to enforce dynamic control plane and data plane boundaries across hybrid environments. Pair each Zero Trust logical component on the left with its precise operational function on the right.

  • Policy Engine (PE)Applies enterprise trust algorithms to contextual telemetry and access rules to determine whether to grant, deny, or revoke access to a requested resource.
  • Policy Administrator (PA)Executes governance decisions by issuing control commands or short-lived credentials to initiate, reconfigure, or sever the communication path between subject and resource.
  • Policy Enforcement Point (PEP)Operates within the data plane to inline-intercept access requests, forward session metadata to the control plane, and enforce connection state rules.
  • Continuous Diagnostics and Mitigation (CDM) SystemContinuously gathers enterprise asset state, patch levels, and vulnerability metrics to feed real-time compliance inputs into control plane decision logic.

Answer

Policy Engine (PE) matches with applying enterprise trust algorithms to determine access decisions; Policy Administrator (PA) matches with executing governance decisions by issuing control commands or credentials to manage the connection path; Policy Enforcement Point (PEP) matches with operating in the data plane to intercept traffic and enforce connection states; Continuous Diagnostics and Mitigation (CDM) System matches with continuously gathering asset health metrics to feed real-time compliance inputs.
In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly separated between decision-making, administration, enforcement, and environmental telemetry. The Policy Engine evaluates trust algorithms to decide access; the Policy Administrator signals session establishment or teardown; the Policy Enforcement Point intercepts data plane traffic to enforce session commands; and the Continuous Diagnostics and Mitigation System provides real-time posture feeds to dynamically reassess trust.

Step-by-Step Solution

1
Differentiate control plane components from data plane components in NIST SP 800-207 Zero Trust Architecture.
Identified Policy Engine and Policy Administrator as control plane entities (PDP), PEP as data plane boundary, and CDM as an external security input source.
Establishing plane separation is required to evaluate structural roles.
2
Differentiate the decision component from the execution component within the control plane.
The Policy Engine evaluates rules to make access decisions, whereas the Policy Administrator commands session creation or termination.
Conflating PE and PA roles is a common architectural error.
3
Identify the data plane component responsible for inline enforcement.
The Policy Enforcement Point directly intercepts subject traffic and enforces PA instructions.
The PEP is the only component listed that resides directly in the traffic flow path.
4
Identify the contextual state feed component.
The CDM System monitors device health, vulnerability data, and patch state to provide continuous diagnostic inputs to the PE.
Zero Trust decisions require real-time dynamic trust scoring provided by CDM telemetry.

Key Concept

NIST SP 800-207 Zero Trust Architecture Components and Control/Data Plane Separation
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic