800-207 Practice Test

800-207 practice test: what's covered

• ZT Foundations & NIST 800-207
• ZT Pillars & Architecture
• Software-Defined Perimeter
• CISA ZTMM
• Planning/Implementation/Migration
• Governance & Use Cases

Free 800-207 sample questions

1. An executive asks your team to summarize the single guiding idea behind Zero Trust before approving a multi-year program. Which statement best captures the core Zero Trust philosophy as articulated by John Kindervag and codified in NIST SP 800-207?

   • A. Trust is never granted implicitly based on network location or asset ownership; it must be continually evaluated per request
   • B. Internal traffic is inherently trusted, so controls should focus only on the network perimeter
   • C. Once a user authenticates at the VPN, all subsequent resource access can be trusted for the session
   • D. Trust is established by placing assets inside a hardened DMZ that screens north-south traffic
   Show answer

   Correct: A. Zero Trust removes implicit trust derived from network position or ownership. NIST SP 800-207 frames every access as an authenticated, authorized, per-request decision — 'never trust, always verify' — rather than trusting anything inside a perimeter.

2. NIST SP 800-207 defines seven tenets of Zero Trust. Which option correctly states one of those tenets?

   • A. Access to individual enterprise resources is granted on a per-session basis
   • B. All internal subnets are considered trusted once the firewall is in place
   • C. Authentication is performed once at login and reused for the day
   • D. Resources are exposed publicly so that any device can reach them after a VPN handshake
   Show answer

   Correct: A. Per-session, least-privilege access is tenet 4 of NIST SP 800-207. Trust is evaluated for each session/request; authentication and authorization are dynamic and strictly enforced before access, not granted once and reused broadly.

3. In the NIST SP 800-207 logical architecture, which component makes the actual grant/deny access decision?

   • A. Policy Engine (PE)
   • B. Policy Enforcement Point (PEP)
   • C. Policy Administrator (PA)
   • D. Resource Portal Gateway
   Show answer

   Correct: A. The Policy Engine (PE) computes the access decision using the trust algorithm and external inputs. The Policy Administrator (PA) executes that decision by establishing/tearing down the path, and the PEP enforces it at the resource boundary.

4. A subject requests access to a resource. The Policy Engine has rendered a decision. Which component is responsible for executing that decision by instructing the enforcement point to open or close the connection?

   • A. Policy Administrator (PA)
   • B. Policy Engine (PE)
   • C. Policy Enforcement Point (PEP)
   • D. Continuous Diagnostics and Mitigation (CDM) system
   Show answer

   Correct: A. The PE decides; the PA acts on the decision by generating session credentials/tokens and signaling the PEP to establish or terminate the communication path. Together PE+PA form the conceptual Policy Decision Point (PDP).

5. Which two NIST SP 800-207 components are together considered the logical Policy Decision Point (PDP)?

   • A. Policy Engine and Policy Administrator
   • B. Policy Engine and Policy Enforcement Point
   • C. Policy Administrator and Policy Enforcement Point
   • D. Policy Enforcement Point and Resource
   Show answer

   Correct: A. NIST 800-207 splits the PDP into the Policy Engine (decision-making/trust algorithm) and the Policy Administrator (decision execution). The PEP is the separate enforcement component (PEP = PDP's downstream actuator) sitting in the data plane.

Last updated: 2026-10-19

800-207 practice test FAQ