Following NIST SP 800-207, an architect places components in front of a finance application so that each session request is decided by policy and then allowed or blocked at the connection itself. Which division of roles is correct?
Select an answer to reveal the explanation.
Short Explanation
Think of a nightclub: the manager decides who gets in, and the bouncer at the door just acts on that decision. In zero trust, the PDP is the manager and the PEP is the bouncer. Don't let them flip on you — the enforcement point doesn't decide policy.
Full Explanation
NIST SP 800-207 describes the logical components of a zero trust architecture. The policy decision point consists of the policy engine, which evaluates each access request against enterprise policy and inputs such as identity, device posture, threat intelligence, and activity logs, and the policy administrator, which acts on that decision by instructing the enforcement point and issuing session credentials. The policy enforcement point sits in the data path between subject and resource and enables, monitors, and terminates the connection according to the decision. Separating decision from enforcement lets one decision engine control many enforcement points, such as gateways, agents, and proxies. Reversing the roles misplaces the policy logic in the enforcement point and gives the decision point a forwarding job it does not perform. Session encryption and identity storage are supporting functions supplied by other systems, such as TLS and identity providers, rather than the defined duties of the decision and enforcement points. Certificate issuance belongs to a PKI and address translation to network devices; neither defines these components. Exam caveat: in products, the decision and enforcement roles are often delivered by different systems, such as an identity service deciding and a proxy or firewall enforcing. Operational check: trace a test request and identify which component logs the decision and which one allowed or dropped the connection.