SY0-701 Question 17
Single answerA company is replacing its traditional VPN with a Zero Trust architecture for access to internal applications. An employee logs in from a managed laptop and is allowed to access a finance web application. Ten minutes later, the user's behavior analytics score rises sharply after impossible-travel indicators and unusual process activity are detected on the endpoint. Security policy requires immediate reduction of the user's access without relying on network location or broad VLAN segmentation. Which component should evaluate the new risk signals and make the access decision that is then enforced on the session?
- A
Policy Engine, because it evaluates identity, device, and contextual signals to make policy-driven access decisions
- B
Policy Enforcement Point, because it is responsible for calculating adaptive identity risk and authorizing access
- C
Data Plane, because it defines the trust policy and determines whether the subject remains authorized
- D
Implicit trust zone, because it isolates the finance application from the rest of the network and reevaluates user risk
Show answer and explanation
Correct answer: A
Explanation
This question tests understanding of Zero Trust control-plane roles and adaptive identity. The key requirement is continuous, policy-driven reassessment of access based on changing context. In a Zero Trust model, the subject/system requesting access is evaluated using identity, device state, and behavioral or environmental signals. The Policy Engine makes the access decision, often using adaptive identity and other risk inputs. The Policy Administrator translates that decision into configuration or session changes, and the Policy Enforcement Point applies the decision to the actual connection or resource request. The data plane handles operational traffic, while the control plane contains the logic and orchestration for decision-making. Zero Trust also aims at threat scope reduction by preventing broad, standing access based on implicit trust zones such as VPN presence, subnet membership, or office location. These concepts align with NIST SP 800-207 Zero Trust Architecture, which distinguishes the Policy Engine, Policy Administrator, and Policy Enforcement Point and emphasizes continuous evaluation of trust rather than one-time authentication.
- A. Correct.
Correct. In Zero Trust architectures, the Policy Engine is the decision-making component in the control plane. It evaluates inputs such as user identity, device posture, behavioral analytics, geolocation anomalies, and other contextual data to determine whether access should be granted, denied, or changed. In this scenario, adaptive identity and continuous evaluation are required, and the Policy Engine is the component that makes that updated decision. The resulting decision is then carried out by enforcement components.
- B. Incorrect.
Incorrect. The Policy Enforcement Point enforces access decisions, such as allowing, blocking, or terminating a session, but it does not serve as the primary decision authority for evaluating risk and creating policy outcomes. Candidates may choose this option because the PEP is the visible control point in the traffic path, but its role is enforcement rather than policy computation.
- C. Incorrect.
Incorrect. The data plane carries the actual application traffic after access is established and includes systems that process or forward operational traffic. It is not the component that defines trust policy or makes authorization decisions. This distractor targets the misconception that because user traffic flows through the data plane, it must also be where trust decisions are made.
- D. Incorrect.
Incorrect. An implicit trust zone is the opposite of what Zero Trust seeks to minimize. Zero Trust reduces or eliminates assumptions that being on a certain network segment or near an application should automatically confer trust. A trust zone is not an active decision-making component and cannot reevaluate behavioral risk. This option reflects a legacy network-security mindset rather than policy-driven access control.