SESKStuff Everyone Should Know
SESK: Stuff Everyone Should Know · sesk.info/secplus-zero-trust-policy-engine

In NIST's zero trust model, which component makes the final decision to grant access to a resource?

Policy engine, it decides, and the policy administrator carries out the decision.

Start playing free

  1. The policy engine ✔
  2. The policy enforcement point
  3. The data plane switch

Why: The policy engine uses enterprise policy and outside inputs to approve or deny. The policy administrator sets up or tears down the session, and the enforcement point opens and closes the connection.

Huh, didn't know that: The policy engine and policy administrator together form the policy decision point in NIST SP 800-207.

The dad joke
The policy engine never gets tired of saying no. It just calls it a decision.
Like this card?
Play the game

References

Answer: The policy engine. The policy engine uses enterprise policy and outside inputs to approve or deny. The policy administrator sets up or tears down the session, and the enforcement point opens and closes the connection.

  1. NIST SP 800-207, Zero Trust Architecture nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-207.pdf
    responsible for the ultimate decision to grant access to a resource for a given subject
    Checked 2026-10-10.

Think this answer is wrong? Tap "Challenge this answer" on the card in the game and tell us why.

Test yourself in the game

Security & PrivacyWhat is the core premise of zero trust architecture?Security & PrivacyEncrypting a laptop's files mainly protects which part of the CIA triad?Security & PrivacyA file's hash value no longer matches after someone edits the file. Which CIA property was affected?

That's stuff everyone should know.