Study. uk . com
  1. Home
  2. All questions
  3. Question 213

CISSP study material · question 213 of 500

A product implements the policy engine and policy administrator as one service. Is that consistent with SP 800-207, and why does the publication still separate them?

  1. It is inconsistent; the two must run on separate hosts to preserve separation of duties.
  2. It is consistent only where the enforcement point is also merged into the same service.
  3. It is inconsistent unless the control plane and data plane are also merged.
  4. It is consistent; the separation is logical, kept so that the decision role and the execution role stay visible.
Show the answer

Answer: D. It is consistent; the separation is logical, kept so that the decision role and the execution role stay visible.

SP 800-207 notes some implementations treat the engine and administrator as a single service, and divides them into two logical components so their distinct roles remain clear.

Source: NIST SP 800-207 (NIST) — SP 800-207 > 3 Logical Components, Policy administrator

Challenge yourself on this topic → Study as cards