Examkin

Question

Difficulty: Very hardZero Trust Architecture Principles

A security architect is designing an enterprise Zero Trust Architecture (ZTA) baseline aligned with NIST SP 800-207. During a dynamic context evaluation event, distinct logical control plane and data plane components handle distinct duties. Match each Zero Trust logical component on the left with its precise operational role during access decision making and execution on the right.

  • Policy Engine (PE)Evaluates enterprise security policies alongside contextual threat telemetry to synthesize the final decision to grant, deny, or revoke access.
  • Policy Administrator (PA)Issues control plane directives to generate or terminate session credentials and communication paths based on policy decisions.
  • Policy Enforcement Point (PEP)Operates directly in the data plane to inspect, inline-gate, and actively terminate resource traffic flows upon control plane command.
  • Continuous Diagnostics and Mitigation (CDM) SystemFeeds continuous host health, update posture, and asset vulnerability state data into policy decision mechanisms.

Answer

Policy Engine pairs with evaluating policies and telemetry to make access decisions. Policy Administrator pairs with issuing control plane commands to establish or terminate sessions. Policy Enforcement Point pairs with inline data plane inspection and traffic gating. CDM System pairs with providing host health and vulnerability posture data.
In NIST SP 800-207 Zero Trust Architecture, logical responsibilities are strictly demarcated across control plane and data plane boundaries. The Policy Engine (PE) acts as the decision-making body evaluating authorization rules and contextual signals. The Policy Administrator (PA) acts as the control plane gateway issuing session control commands (establishing or severing connections). The Policy Enforcement Point (PEP) sits in the data plane to directly gate, inspect, or drop traffic to enterprise resources. Continuous Diagnostics and Mitigation (CDM) systems provide ongoing host state metrics as inputs into the Policy Engine.

Step-by-Step Solution

1
Differentiate between control plane decision logic and execution components in Zero Trust Architecture (NIST SP 800-207).
Identified the Policy Engine (PE) as the brain that applies security policy algorithms to reach a decision, and the Policy Administrator (PA) as the control component that communicates that decision.
The Policy Engine evaluates context, while the Policy Administrator translates the decision into command signals (such as issuing short-lived credentials or token revocations).
2
Separate data plane execution from control plane governance.
Identified the Policy Enforcement Point (PEP) as the single data-plane component in direct path of resource traffic.
The PEP gates, inspects, enables, or severs actual network connections to resources based on PA instructions.
3
Map threat intelligence and posture telemetry data sources.
Mapped the Continuous Diagnostics and Mitigation (CDM) System as an external signal feeder to the Policy Engine.
ZTA relies on dynamic context, requiring posture indicators like OS patch levels and threat detection states from CDM systems to continually calculate trust scores.

Key Concept

NIST SP 800-207 Zero Trust Architecture Logical Components (Control Plane vs. Data Plane)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic