Examkin

Question

Difficulty: MediumZero Trust Architecture Principles

A defense technology organization is implementing Zero Trust Architecture (ZTA) for field operations. Mobile tactical command units must access centralized intelligence databases across untrusted wireless channels. To strictly adhere to Zero Trust principles, the architecture must decouple control plane policy evaluation from data plane enforcement. Which of the following implementations correctly demonstrates this architectural separation?

  1. A centralized policy engine evaluates real-time device health, user context, and threat intelligence to issue dynamic access decisions, while local gateway proxies inspect and enforce those authorization decisions on incoming data streams.Answer
  2. B
    Once a mobile command unit successfully establishes an encrypted IPsec VPN tunnel into the internal network, all subsequent traffic from that unit to intelligence databases is implicitly trusted without further inspection.
  3. C
    The local edge gateway authenticates user credentials via multi-factor authentication and automatically grants full database access permissions without conducting dynamic authorization or ongoing context checks.
  4. D
    An inline intrusion prevention system (IPS) is deployed at the satellite gateway to automatically rewrite SQL database queries and remediate application layer software buffer overflow vulnerabilities.

Answer

The implementation where a centralized policy engine evaluates real-time context and dynamic risk factors to issue access decisions, while local gateway proxies enforce those authorization decisions on data streams.
Decoupling control plane policy decisions from data plane enforcement is a foundational Zero Trust Architecture principle. The centralized engine acts as the Policy Decision Point (PDP), using dynamic trust signals (user identity, device posture, location) to decide access, while the gateway proxy acts as the Policy Enforcement Point (PEP) to grant or drop sessions dynamically.

Step-by-Step Solution

1
Identify the core Zero Trust components required for decoupling control plane evaluation from data plane enforcement.
The control plane is represented by the Policy Decision Point (PDP), while the data plane is represented by the Policy Enforcement Point (PEP).
Zero Trust relies on separate functional components to make access decisions (PDP) and apply those decisions to network traffic (PEP).
2
Evaluate the role of the centralized policy engine versus the local gateway proxy.
The centralized policy engine functions as the PDP by continually assessing trust factors, whereas the inline gateway proxy functions as the PEP by granting or denying individual packet flows.
This guarantees per-request explicit verification without allowing implicitly trusted zones.

Key Concept

Decoupling Policy Decision Points (PDP) from Policy Enforcement Points (PEP) in Zero Trust Architecture
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic