2.2.4. Zero Trust Architecture

💡 First Principle: Zero Trust is an architecture where no entity — user, device, or application — is inherently trusted, regardless of network location. Every access request is fully authenticated, authorized, and encrypted. The mantra: "never trust, always verify."

The exam specifically tests the two planes:

Control Plane — the decision-making layer:

• Adaptive identity — adjusting authentication requirements based on risk context (location, device health, behavior)
• Threat scope reduction — limiting the blast radius of any compromise through micro-segmentation
• Policy-driven access control — decisions based on policy rules rather than network location
• Policy Administrator — establishes and removes access based on policy engine decisions
• Policy Engine — evaluates access requests against policies and makes allow/deny decisions (NIST SP 800-207 groups the Policy Engine and Policy Administrator as the Policy Decision Point, PDP; the PEP is the enforcement point)

Data Plane — the enforcement layer:

• Implicit trust zones — minimal trust areas (vs. the traditional model where the entire internal network is trusted)
• Subject/System — the entity requesting access
• Policy Enforcement Point (PEP) — the gateway that enforces the policy engine's decision. The PEP is the only path to protected resources — there's no way to bypass it. Every request, whether from an employee's laptop or a server API call, passes through the PEP.

Implementation reality: Zero Trust doesn't mean ripping out existing infrastructure. Organizations implement it incrementally: start with identity verification (MFA everywhere), add device health checks (only compliant devices access sensitive resources), then layer in micro-segmentation and continuous monitoring. Each step reduces implicit trust. The goal is that network location alone never grants access — an attacker on the internal network faces the same authentication requirements as one on the internet.

⚠️ Exam Trap: Know which components belong to which plane. Policy Engine and Policy Administrator are Control Plane (they decide). Policy Enforcement Point is Data Plane (it enforces). Subject/System is also Data Plane.