CompTIA SecurityX (CAS-005)Security ArchitectureMedium
A financial services organization is adopting a Zero Trust architecture. The security team wants to ensure that every access request, regardless of origin (internal or external), is continuously evaluated against granular policies before granting access to resources. This evaluation must consider user identity, device posture, location, and the sensitivity of the requested resource. Which Zero Trust component is primarily responsible for making the real-time access decision?
- AContinuous Diagnostics and Mitigation (CDM)
- BSecurity Policy Administrator (SPA)
- CPolicy Decision Point (PDP)
- DPolicy Enforcement Point (PEP)
Show answer & explanationAnswer & explanation
Correct answer: C. Policy Decision Point (PDP)
The Policy Decision Point (PDP) is the brain of the Zero Trust architecture, responsible for evaluating all available context (user, device, resource, environment) against defined policies to make a real-time decision on whether to grant or deny access. It instructs the PEP to enforce this decision.
Why the other options are wrong
- A. Continuous Diagnostics and Mitigation (CDM) is a framework for improving cybersecurity, not a specific Zero Trust component for real-time access decisions.
- B. Security Policy Administrator is a role or function, not a technical component within the Zero Trust model for making automated access decisions.
- D. The Policy Enforcement Point (PEP) enforces the access decision made by the PDP, but does not make the decision itself.
Zero Trust Policy Decision Point (PDP)
The logical component in a Zero Trust architecture responsible for evaluating authorization requests against policies and making real-time access decisions.
- Receives contextual information (user, device, resource, environment).
- Applies defined security policies to make an access decision (grant/deny).
- Communicates the decision to the Policy Enforcement Point (PEP).
Memory trick: In Zero Trust, the 'traffic light' (PEP) waits for the 'judge' (PDP) to tell it what to do.