Examkin

Question

Difficulty: EasyZero Trust Architecture Principles

Match each Zero Trust Architecture (ZTA) functional component on the left with its corresponding operational role on the right.

  • Policy Engine (PE)Evaluates enterprise security policies, trust scores, and contextual attributes to make access decisions.
  • Policy Administrator (PA)Issues commands to configure the communication path and manage session credentials based on decisions.
  • Policy Enforcement Point (PEP)Intercepts network traffic, monitors sessions, and directly applies access control decisions to resource requests.
  • Data PlaneTransports actual user workload and application traffic between subjects and resources once authorized.

Answer

Policy Engine matches with evaluating security policies and context; Policy Administrator matches with issuing control commands to manage connections; Policy Enforcement Point matches with intercepting traffic and enforcing access controls; Data Plane matches with carrying actual application payload traffic.
Each Zero Trust architecture component serves a distinct role split across the control plane and data plane. The Policy Engine (PE) evaluates policies and context to determine authorization. The Policy Administrator (PA) generates signals and credentials to open or close sessions. The Policy Enforcement Point (PEP) acts as the inline mechanism enforcing access. The Data Plane carries the actual payload once allowed.

Step-by-Step Solution

1
Identify the decision-making brain of Zero Trust Architecture.
The Policy Engine (PE) processes rules and context to make authorization decisions.
ZTA relies on dynamic evaluation of trust before access is decided.
2
Identify the control signaling component.
The Policy Administrator (PA) executes decision commands to control connection establishment.
PA coordinates between the decision engine and enforcement mechanisms.
3
Identify the inline gatekeeper component.
The Policy Enforcement Point (PEP) directly inspects and controls subject access requests.
Enforcement must happen directly at the gateway or endpoint interface.
4
Identify the network layer responsible for user payload.
The Data Plane transports application user data separate from control signals.
NIST SP 800-207 mandates separation between the control plane and data plane.

Key Concept

Zero Trust Functional Components (NIST SP 800-207)
Rate this question

Topics

Zero Trust Architecture Principles

More questions from this topic