hardMultiple ChoiceObjective-mapped

CAS-004 Is migrating to a zero-trust architecture Practice Question

An organization is migrating to a zero-trust architecture. Which of the following components is CRITICAL for enforcing policy decisions based on user identity, device health, and context?

⚠ Common exam trap

Watch out — candidates often confuse Network Access Control (NAC) with zero-trust policy enforcement, but NAC only controls initial network admission, whereas a PEP enforces continuous, context-aware decisions per session or request.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Policy enforcement point (PEP)

In a zero-trust architecture, the Policy Enforcement Point (PEP) is the critical component that enforces access decisions by mediating all traffic between users and resources. It evaluates policies based on user identity, device health, and contextual attributes (e.g., location, time) before allowing or denying access, aligning with the NIST SP 800-207 zero-trust framework.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Intrusion prevention system (IPS)
Why it's wrong here
IPS detects and blocks threats but does not make policy-based access decisions.
✗
Web application firewall (WAF)
Why it's wrong here
WAF protects web applications but does not enforce identity-based policies.
✓
Policy enforcement point (PEP)
Why this is correct
PEP is the decision point that enforces access policies based on identity and context.
✗
Network access control (NAC)
Why it's wrong here
NAC controls network access but is not the primary policy enforcement point in zero-trust.

Go deeper

CAS-004 Is migrating to a zero-trust architecture Practice Question

Why each option matters

Option-by-option breakdown

Related to this question