Which component in zero trust architecture is responsible for defining policy and making access decisions?

Which component in zero trust architecture is responsible for defining policy and making access decisions?

• A. Data plane
• B. Identity store
• C. Control plane
• D. SCADA

Answer: (C)

In zero trust, deciding who is allowed to access what is handled by the control plane. This part of the architecture contains the policy engine that defines rules and evaluates each access request—taking into account identity, device posture, location, compliance status, and other context. Based on those evaluations, the control plane issues a decision (permit or deny) to enforce the rule set. The data plane is where the actual traffic is allowed or blocked according to that decision, enforcing what the control plane has determined. The identity store simply provides the identities and attributes used during policy evaluation, but it does not define or enforce access rules itself. SCADA is not part of the typical zero trust control/decision framework.

In zero trust, deciding who is allowed to access what is handled by the control plane. This part of the architecture contains the policy engine that defines rules and evaluates each access request—taking into account identity, device posture, location, compliance status, and other context. Based on those evaluations, the control plane issues a decision (permit or deny) to enforce the rule set.

The data plane is where the actual traffic is allowed or blocked according to that decision, enforcing what the control plane has determined. The identity store simply provides the identities and attributes used during policy evaluation, but it does not define or enforce access rules itself. SCADA is not part of the typical zero trust control/decision framework.