Objective 1.2: Summarize fundamental security concepts
Security+ SY0-701 practice question
A company is moving to a zero trust architecture. When a contractor's laptop requests access to an internal HR application, one component evaluates the contractor's identity, the laptop's security posture, and current threat intelligence against the access policy, and then decides whether to grant, deny, or revoke access. A different component carries out that decision by setting up or tearing down the communication path. Which component makes the access decision?
- Policy enforcement point
The policy enforcement point is the data-plane gatekeeper between the subject and the resource. It enables, monitors, and terminates connections as instructed, but it does not evaluate policy or make the decision.
- Policy administrator
The policy administrator executes the policy engine's decision, for example by issuing session credentials and telling the enforcement point to open or close the path. It is the component the stem describes as carrying out the decision, not the one that makes it.
- Policy engine(Correct)
Correct. The policy engine is the decision-maker in the control plane. It weighs identity, device posture, threat intelligence, and other signals against policy to grant, deny, or revoke access.
- Implicit trust zone
An implicit trust zone is the area behind an enforcement point where entities are trusted once they pass the gate. It is a region of the data plane, not a component that makes decisions, and zero trust tries to keep such zones as small as possible.
Explanation
In zero trust, the control plane decides and the data plane enforces. The policy engine evaluates the request (identity, device posture, threat data, policy) and makes the grant, deny, or revoke decision. The policy administrator acts on that decision by establishing or shutting down the communication path, and it instructs the policy enforcement point, which sits in the data plane and actually allows, monitors, or terminates the connection.