I85PREP
⌘ K
CSA CCZT study materials
CSA CCZT study resources

CSA CCZT: Software Defined Perimeter

CSA CCZT · Work through your exam, one topic at a time.

All guide sections

Software Defined Perimeter

Software Defined Perimeter (SDP) is the CSA-originated architecture most closely associated with zero trust network access. The exam tests SDP components, the control/data plane split, Single Packet Authorization (SPA), the 'dark cloud' model, and SDP deployment variants, including the cloud-native guidance in NIST SP 800-207A.

Core rules

  • SDP follows a need-to-know model: a client sees nothing-no DNS, no open ports-until it is authenticated and authorized for a specific resource. This is the 'dark cloud.'
  • Components: SDP Controller (policy and orchestration), SDP Client (on the device), and SDP Gateway/Host (in front of the protected resource). The controller is the control plane; the gateway carries the data plane.
  • SPA is the front door: the client sends a single authenticated packet (typically HMAC-protected) to a default-drop firewall. Only after validation does the controller provision a per-session connection. SPA is not port knocking.
  • Deployments: client-to-gateway, gateway-to-gateway, client-to-server, and server-to-server. Mutual TLS and device posture attestation are common.
  • NIST SP 800-207A extends SDP thinking to cloud-native environments, using service mesh and identity-aware proxies.

Worked example

An administrator needs SSH to a cloud server. The server's security group drops all inbound traffic. The SDP client sends an SPA packet signed with a shared key and containing the user identity and requested host. The controller validates the packet, checks the user's group and device posture, and instructs the gateway to allow a temporary tunnel. The gateway proxies the SSH session, and the server remains invisible to scanners. The reasoning: authorization precedes network visibility, and the data plane connection is created only after the control plane decision.

Traps that cost marks

  • Calling SDP a VPN. A VPN grants network access; SDP grants per-resource access.
  • Confusing the controller with the gateway; the controller does not carry user traffic.
  • Treating SPA as ordinary port knocking. SPA authenticates before any TCP handshake.
  • Assuming SDP alone encrypts application data end to end.