📖 What is Policy Decision Point (PDP)?
Policy Decision Point (PDP) is the logical entity within a Zero Trust Architecture that evaluates a request against defined security policies to determine if access should be granted. It acts as the brain of the access control system, analyzing user identity, device health, and context.
"Remember that the PDP only makes the decision; it does not actually block the traffic. It tells another component whether the request is allowed or denied."
📚 Certification: CompTIA Advanced Security Practitioner+ (CAS-004)
🔑 What are the Key Concepts of Policy Decision Point (PDP)?
- ▸ Centralized logic in Zero Trust Architecture that evaluates access requests based on identity, device posture, and environmental context before granting access.
- ▸ The PDP acts as the decision-making 'brain,' while the Policy Enforcement Point (PEP) serves as the 'muscle' that actually blocks or allows traffic.
- ▸ PDPs query Policy Information Points (PIPs) to gather real-time attributes, such as user location or threat intelligence, to inform the final access decision.
- ▸ The PDP retrieves governing rules and security policies from the Policy Administration Point (PAP), ensuring consistent policy application across the entire enterprise.
- ▸ Unlike static ACLs, the PDP performs continuous evaluation, meaning access can be revoked instantly if the user's risk score or device health changes.
🎯 How does Policy Decision Point (PDP) appear on the CAS-004 Exam?
You may be asked to identify the specific component responsible for analyzing a user's risk score and device health to decide if they should access a sensitive database.
A scenario might describe a failure where a user is denied access despite having correct credentials; you must determine if the issue lies with the PDP's logic or the PEP's enforcement.
Expect questions about the request flow in a Zero Trust environment, requiring you to sequence the interaction between the PAP, PDP, PIP, and PEP.
❓ Frequently Asked Questions
What is the primary difference between a PDP and a PEP?
The PDP is the decision-making engine that evaluates policies and determines if a request is authorized. The PEP is the actual gateway or agent that executes that decision by permitting or dropping the network traffic.
How does the PDP handle real-time threats during a session?
The PDP integrates with Policy Information Points (PIPs), such as SIEMs or EDRs. If a PIP reports a compromised device mid-session, the PDP can immediately update its decision to 'Deny,' signaling the PEP to terminate the connection.