Enforcement Point, Engine or Administrator?

About this interactive

A zero trust network splits access into a data plane and a control plane. The subject, a user or device, asks for a resource. In the data plane, the policy enforcement point stands between them: it catches the request, passes it to the control plane, and then opens or closes the path when it is told. The control plane is the policy decision point, and it has two parts. The policy engine holds the rules on what is allowed and decides whether this subject gets this resource. The policy administrator carries that decision to the enforcement point, telling it to open the session or shut it. One correction to the video: it says the policy administrator gives the yes or no. In NIST SP 800-207, which defines these components, the policy engine makes the decision (grant, deny or revoke) and the policy administrator acts on it by instructing the enforcement point. To sort a card, ask whether the job is guarding the path, deciding, or passing the decision on.

What you'll learn

Assign a job in a zero trust access request to the policy enforcement point (data plane), the policy engine or the policy administrator (control plane)
Explain that the policy engine decides and the policy administrator carries the decision to the enforcement point, as NIST SP 800-207 defines them

Aligned to

CompTIA Security+

1.2 Summarize fundamental security concepts.

Key terms

Policy Enforcement Point: The component in a Zero Trust architecture that intercepts a subject's request for a resource and enforces the access decision returned by the control plane.
Policy Engine: The component within the Zero Trust control plane that evaluates requests against defined rules and policies to determine whether access should be granted.
Policy Administrator: The control plane component that communicates the policy engine's access decision to the policy enforcement point, issuing a grant or deny instruction.
Control Plane: The part of a network device responsible for making routing and policy decisions, such as running routing protocols to build and maintain the routing table, which the data plane then uses to forward traffic. The control plane handles the intelligence of the network while the data plane handles the actual packet forwarding.
Data Plane: The part of a network device responsible for actually forwarding packets toward their destinations based on rules and tables built by the control plane. In a router, the data plane looks up each packet's destination in the forwarding table and sends it out the correct interface at high speed.

Topics

Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →