The zero trust architecture of NIST SP 800-207 separates the "policy decision point (PDP)", which decides whether to allow access, from the "policy enforcement point (PEP)", which carries out the decision. Which of the following correctly describes how the two work when an employee accesses a business application?

Answer: B. The PDP decides by checking the authentication result and the device state against the policy, and the PEP between the user and the application lets connections through or cuts them off according to that decision

In SP 800-207 the PDP, made up of the policy engine and the policy administrator, decides whether to allow access by checking the user's authentication result, the state of the device, the importance of the resource being accessed, threat information and so on against the policy. The PEP sits on the path between the user and the resource and enables, monitors and terminates connections according to the PDP's decision. Separating decision and enforcement lets the policy be managed in one place while being applied in the same way at the entrances of many applications. Also, if the state of the device or other factors changes, the decision can be revisited even during a connection and the access stopped.

• A. The PDP decides and the PEP enforces; the roles are reversed.
• B. Correct. Decision (PDP) and enforcement (PEP) are separated, and the PEP carries out the decision between the user and the resource.
• C. They are separate roles. In zero trust, the decision is revisited according to changes in state even after a connection is allowed.