CompTIA SecurityX (CAS-005)Security ArchitectureMedium
A large enterprise is adopting a Zero Trust architecture. The security team is implementing a system that continuously evaluates the security posture of every device and user attempting to access corporate resources, regardless of their location. Which component of Zero Trust is primarily responsible for making real-time access decisions based on these evaluations?
- APolicy Information Point (PIP)
- BPolicy Enforcement Point (PEP)
- CMicro-segmentation Gateway
- DPolicy Decision Point (PDP)
Show answer & explanationAnswer & explanation
Correct answer: D. Policy Decision Point (PDP)
In a Zero Trust architecture, the Policy Decision Point (PDP) is the component that evaluates all available contextual information (from PIPs) against defined policies to determine whether an access request should be granted or denied. It makes the 'decision' in real-time.
Why the other options are wrong
- A. The Policy Information Point (PIP) acts as a source of attributes or context that the PDP uses to make decisions, such as device health, user location, or resource sensitivity, but it does not make the decision.
- B. The Policy Enforcement Point (PEP) is responsible for enforcing the access decision made by the PDP, such as allowing or blocking traffic, but it does not make the decision itself.
- C. Micro-segmentation is a technique used to enforce granular network access policies, often implemented by the PEP, but it's not the decision-making component itself.
Zero Trust Policy Decision Point (PDP)
In a Zero Trust architecture, the Policy Decision Point (PDP) is the component responsible for evaluating all relevant contextual information and security policies to make real-time access decisions (grant or deny) for any user or device attempting to access a resource.
- Acts as the 'brain' for access decisions.
- Evaluates context: user, device, resource, environment.
- Consults policies to determine access rights.
- Communicates decisions to the Policy Enforcement Point (PEP).
Memory trick: The gatekeeper asks, the brain decides, the guard acts.