Which Zero Trust Component Belongs to the Data Plane?

Summarize fundamental security concepts.

An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?

Secured zones
Subject role Correct Answer
Adaptive identity
Threat scope reduction

Answer Correct answer: B — Subject role is the Zero Trust data plane element; secured zones, adaptive identity, and threat scope reduction are all control plane components.

Community Votes

41%

40%

18%

41% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The question tests whether you can map Zero Trust components onto the control plane versus the data plane, and the trap is picking "secured zones" because network segmentation sounds like it handles data traffic rather than policy definition.

Zero Trust separates its architecture into a control plane and a data plane, and the SY0-701 exam expects candidates to know which component lives where. This page establishes that subject role (B) is the data plane element, while secured zones, adaptive identity, and threat scope reduction are control plane constructs.

Choosing A (secured zones) is the most common error: micro-segmentation feels like a data plane activity to many learners, but CompTIA defines secured zones as part of the control plane alongside adaptive identity and threat scope reduction.

Community Discussion (59 comments)

SHADTECH123 👍 27 Selected: A

A. Secured Zones Explanation: In the context of implementing Zero Trust principles within the data plane, secured zones are most relevant. Zero Trust principles emphasize the need to eliminate implicit trust and enforce strict access controls. By evaluating and implementing secured zones, an organization can ensure that data is compartmentalized and that access is tightly controlled, aligning with the core tenets of Zero Trust. This approach helps to contain threats and limit lateral movement within the network, providing a strong foundation for a Zero Trust architecture.

AutoroTink 👍 20 Selected: B

From Dion Training: Control Plane: Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control, and secured zones. Data Plane: Subject/system, policy engine, policy administrator, and establishing policy enforcement points. (I've also been trying to verify this from other locations...it's been a challenge!)

ItAd 👍 1 Selected: B

Zero Trust principles within the data plane focus on enforcing strict access controls to ensure that only authorized entities (subjects) can access specific data resources. Evaluating subject roles aligns with Zero Trust because: Least Privilege Access: Zero Trust enforces the principle of least privilege, meaning that access to data is granted based on predefined roles and responsibilities. Role-Based Access Control (RBAC): Subject roles define what actions a user, service, or device can perform on data within the data plane. Continuous Verification: Access is granted dynamically based on role, identity, and other contextual factors (e.g., device security posture or network conditions).

gcracker618 👍 1 Selected: B

This question stinks. At first I would have answered "A" as Implicit trust zones are part of the Data Plane and it was listed first. HOWEVER, the BEST answer is likely Subject role. Subject role is listed as part of data plane in much more plain, simple terms.

Ejigi 👍 1 Selected: C

The decision to trust is based upon adaptive identity authentication (get certified, get ahead)

Oluwatobi4880 👍 1 Selected: B

When evaluating the implementation of Zero Trust principles within the data plane, the most relevant factor for an analyst to evaluate would be: B. Subject role It is crucial to assess how roles and identities are managed and enforced to ensure secure access and control within the Zero Trust framework. By focusing on subject roles, the analyst can determine how access controls and permissions are applied to users, ensuring that only the right individuals have access to the necessary data, consistent with the principles of Zero Trust.

KSoLL 👍 1 Selected: B

B. Subject role Keywords in this question is [Data plane] & [Zero Trust] The control plane layout the policies and procedures Control plane typically encompasses several key elements: 1. Adaptive identity 2. Threat Scope Reduction 3. Policy-Driven Access Control 4.Secured Zones The data plane is going to ensure that the policies properly executed Data planes consists of: 1. Subject/System 2. Policy Enforcement Point I got this information from Jason Dion videos [Section 2: Fundamentals of Security - 15. Zero Trust (OBJ 1.2)

oldbutgold 👍 1 Selected: D

Control Plane: Manages policies, including Adaptive Identity, Policy-Driven Access Control, Threat Scope Reduction, and the Policy Decision Point. (Source: CompTIA official guide - Latest) Data Plane: Implements the policies set by the control plane and includes Subject (user/device), Policy Enforcement Points, and Implicit Trusted Zones Source: CompTIA official guide - Latest) The question specifically asks about implementing Zero Trust principles in the data plane. The role of a subject (B) is part of the data plane, but it does not define how Zero Trust is implemented. Instead, Threat Scope Reduction (D) ensures that subject access is restricted to the minimum necessary resources, which is a key principle in the data plane.

selom1 👍 1 Selected: A

It's crucial for implementing Zero Trust at the data movement level and this provides concrete controls over actual data flows

gavin1776 👍 1 Selected: D

I couldn't make up my mind with all of the different answers, every AI tool said D so that's what i went with.

deedee2025 👍 1 Selected: A

I thought it was A but i see B is the most voted. can anybody explain to me why. Also who needs a reading partner to write in 3 weeks max

Markie100 👍 1 Selected: C

Yes, adaptive identity is also highly relevant when evaluating the implementation of Zero Trust principles within the data plane.

suL33T 👍 1 Selected: C

When evaluating the implementation of Zero Trust principles within the data plane, the analyst should focus on the Policy Enforcement Point (PEP). The PEP is a critical component of the data plane in a Zero Trust architecture. It acts as the gateway for secure access to corporate resources, enforcing adaptive access control capabilities. The PEP intercepts access requests, authenticates the requestor through the Policy Administrator (PA), and dynamically authorizes access based on policy decisions.

vm_mscs 👍 1 Selected: C

Specialist evaluate Zero Trust. At this stage roles shall be assigned. When user changes current zone to data zone leaving current trust level he must be get new (elevated) authorization.

Rackup 👍 1 Selected: D

Answer: D. Threat scope reduction Explanation: Threat scope reduction is most relevant when evaluating the implementation of Zero Trust principles, as Zero Trust focuses on minimizing the attack surface and reducing the scope of potential threats. This involves continuously verifying access and limiting user and device access based on the least privilege principle. By evaluating threat scope reduction, the analyst can ensure that resources are only accessible based on the minimal necessary access, which is a core tenet of Zero Trust architecture.

bility 👍 1 Selected: A

When implementing Zero Trust principles within the data plane, the focus is on controlling access to data and resources through segmentation, microsegmentation, and secured zones. These strategies help limit lateral movement and ensure that only authorized subjects

babujiju 👍 2 Selected: A

The most relevant choice for evaluating the implementation of Zero Trust principles within the data plane is: A. Secured zones Explanation: Secured zones align closely with the Zero Trust principle of micro-segmentation. In the data plane, creating and enforcing secured zones means that traffic between different parts of the network is strictly controlled and inspected. This minimizes lateral movement of threats and ensures access is limited to authorized users and devices. It focuses on isolating resources and enforcing policies at a granular level, which is a core tenet of Zero Trust.

gollum9 👍 1 Selected: A

A. Secured Zones first

musaabokisec 👍 1 Selected: A

When evaluating Zero Trust principles within the data plane, the focus is on protecting the data and ensuring secure communication between entities, such as users, devices, or applications. The concept of "secured zones" is directly tied to implementing Zero Trust in the data plane because it involves segmenting and securing traffic and resources

ProudFather 👍 1 Selected: C

C. Adaptive identity Explanation: In the context of Zero Trust principles within the data plane, evaluating adaptive identity is most relevant because the data plane involves managing and securing access to data. Adaptive identity focuses on verifying users, devices, and other entities continuously based on their behavior, context, and real-time security posture, which is a critical aspect of Zero Trust in securing the data plane.

41c27e6 👍 1 Selected: A

for secured zones (segmentation of network) - > only DATA PLANE. Control plane would be more relevant for granting permissions and roles of users in according to the policies.

tbyrd 👍 1 Selected: A

Secured Zones is correct

Exam_Prep221 👍 1 Selected: D

In the context of Zero Trust principles and the data plane, the most relevant aspect for the analyst to evaluate is "threat scope reduction".

ProudFather 👍 1 Selected: D

D. Threat scope reduction Zero Trust in the data plane focuses on minimizing the attack surface by restricting access to data and resources. Threat scope reduction aligns with this principle by limiting the potential impact of a security breach. By segmenting networks, implementing micro-segmentation, and using granular access controls, organizations can reduce the scope of a potential attack.

Olaunfazed 👍 2 Selected: B

When evaluating the implementation of Zero Trust principles within the data plane, the primary focus is on ensuring that access to data is tightly controlled based on who the subject is (identity), their role, and their permissions. Zero Trust principles require constant verification of the subject's role and access rights before allowing data access, emphasizing least privilege and context-aware decision-making.

Dimpo_Oz 👍 1 Selected: C

Adaptive Identity (C): Zero Trust principles emphasize continuous authentication and authorization based on real-time context and behavior. Adaptive identity refers to the dynamic adjustment of access control based on factors such as the user's identity, location, device health, and behavior patterns. This is highly relevant in the data plane as it ensures that even after initial authentication, access is continuously reassessed based on changing conditions, aligning with Zero Trust's goal of not trusting any entity, inside or outside the network, by default.

MLKTKN 👍 1

The most relevant option for evaluating the implementation of Zero Trust principles within the data plane would be: A. Secured zones Explanation: In a Zero Trust model, "secured zones" involve segmenting and isolating data and resources to minimize unauthorized access and limit the lateral movement of threats. This approach aligns with the core Zero Trust principle of assuming no implicit trust and enforcing strict access controls within the data plane. By focusing on secured zones, the analyst would be evaluating how data and resources are isolated and protected within the network, ensuring that sensitive areas are protected and access is tightly controlled.

MLKTKN 👍 1

cyberWoof 👍 1 Selected: A

'A' - secured zones aligns closely with the Zero Trust approach of limiting access on the data plane to reduce potential attack surfaces and mitigate risks

braveheart22 👍 2 Selected: D

Zero Trust focuses on the principle of "never trust, always verify," and it emphasizes minimizing the attack surface and reducing the scope of potential threats. Within the data plane (which handles the flow of data across a network), threat scope reduction is particularly important because it involves minimizing access to data and services based on strict verification and least-privilege principles. Threat scope reduction is a critical component of Zero Trust because it reduces the areas within a network where threats could potentially spread, making it harder for malicious actors to move laterally within the environment. It limits access to only what is necessary for each user or service, ensuring that any compromised component doesn’t expose unnecessary parts of the system.

KelvinYau 👍 2 Selected: D

Ans are A/B/D is correct

KelvinYau 👍 2 Selected: D

Secured zones are a concept related to the control plane, which is the part of the network that makes routing and switching decisions. Subject role is a concept related to the identity plane, which is the part of the network that authenticates and authorizes users and devices. Adaptive identity is a concept related to the policy plane, which is the part of the network that defines and enforces the security policies and rules.

QFox 👍 1 Selected: D

Threat scope reduction is most relevant in the data plane when implementing Zero Trust principles, as it focuses on limiting the attack surface and controlling how data is accessed and what data is exposed. This aligns with the goal of reducing potential threats within the data layer, which is critical to securing sensitive data under Zero Trust principles.

c7b3ff0 👍 2 Selected: B

B because... Zero Trust occurs in the DATA plane (which the question is asking for) and the CONTROL plane (which it is not asking for). Control Plane: Adaptive identity, Threat Scope Reduction, Policy-Driven Access Control, Secured Zones Data Plane: Subject/system, policy engine, policy administrator, and establishing policy encforcement plans Subject is the only answer, it's not A, A is control plane.

latshar 👍 1

A is correct variant.

camillejonessm 👍 2 Selected: B

Subject Roles affect data planes

TestingSun42 👍 3 Selected: B

Secured Zone = Control Plane Subject Role = Data Plane Check the study guide to conform this for yourself

Nehaltarek 👍 1

Secured zones are crucial because they directly relate to how data and resources are segmented and protected. Evaluating secured zones helps in understanding how well the network segmentation aligns with Zero Trust principles, which emphasize minimizing trust assumptions and controlling access based on least privilege.

PAWarriors 👍 3 Selected: B

Correct answer should be B. Control Plane: Refers to the overarching framework and set of components responsible for defining, managing, and enforcing the policies related to user and system access within an organization. Control Plane typically encompasses several key elements --> Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control and Secured Zones (Isolated environments within a network that are designed to house sensitive data). Data Plane: Ensures the policies are properly executed and consists of the following --> Subject/System (Refers to the individual or entity attempting to gain access), Policy Engine, Policy Administrator and Policy Enforcement Point.

pedrwc7 👍 5 Selected: B

A. Secured zones (Control Plane) B. Subject role (Data Plane) C. Adaptive identity (Control Plane) D. Threat scope reduction (Control Plane)

dbrowndiver 👍 3 Selected: A

In this scenario, the analyst is evaluating Zero Trust principles specifically within the data plane. The data plane in network architecture refers to the part of a network that carries user data, as opposed to the control plane, which manages network functions. Implementing Zero Trust in the data plane focuses on securing data access and communication.

Gominolo 👍 4 Selected: B

B. Subject Subject is one of the core components of the Data plane

kinny4000 👍 4 Selected: B

Subjects are the only principle associated strongly with the data plane, everything else applies more to the control plane or zero trust in general. The question says "WITHIN the data plane"

Olekjs 👍 1

A. Secured zones Most Voted

noragami 👍 2

The most relevant aspect for an analyst to evaluate when implementing Zero Trust principles within the data plane would be: A. Secured zones Zero Trust principles emphasize the importance of securing all communication and data transactions within the network. Implementing secured zones involves segmenting the network into smaller, isolated sections to minimize the risk of unauthorized access and lateral movement of threats. This is crucial in the data plane, where data is actively processed and transferred, as it ensures that each zone is tightly controlled and monitored, adhering to Zero Trust's "never trust, always verify" approach.

chadbigman 👍 2 Selected: C

Adaptive identity is about continuously evaluating and adapting permissions based on the context and risk. This aligns closely with Zero Trust principles, which require dynamic, context-aware, and continuous verification of identity and access.

TheMichael 👍 2 Selected: D

I thought you guys might appreciate some clarification on this. The question asks what zero-trust principle the the analyst should focus on within the data plane. Zero Trust in the Data Plane: In the data plane, Zero Trust focuses on securing the data itself, minimizing the potential damage caused by unauthorized access, even if lateral movement occurs. So it's not (A.) because Secured zones are in the control plane. It's not (B.) because b is not a principle of the data plane but rather a component. It's not (C.) because that's part of the control plane The answer is most likely (D.) because it's a principle of zero trust that directly applies to the data plane. What about this answer reduces threat scope within the data plane? -Data encryption -access controls at the data level -minimizing data access These all contribute to threat scope reduction within the data plane.

Etc_Shadow28000 👍 2 Selected: A

Answer A. Secured zones Zero Trust principles advocate for continuous verification of users and devices, and the segmentation of networks into smaller, secure zones to reduce the attack surface. This means evaluating how well the data plane is segmented into secured zones, ensuring that sensitive data is accessed only by authenticated and authorized users and devices, and that lateral movement within the network is restricted. - B This pertains more to identity and access management, ensuring that roles and permissions are correctly assigned and managed. - C This involves dynamically adjusting identity verification based on context and behavior, which is more relevant to authentication and access control rather than the data plane. - D This is a broad concept that involves minimizing the potential impact of threats, which can be achieved through various means, including secured zones, but is not specific to the data plane.

f26ddcd 👍 2 Selected: A

“Data plan” = secured zones

hasquaati 👍 1 Selected: D

This is a tough question, because A and C are sort of correct. In Zero Trust, you can sort of create ZT zones and ZTA can also be adaptive as well depending on the rights and privileges of users and also the device posture of the endpoint, however I think the question is talking about what the over all goal is and what the general solution is. Which is why I am leaning for D: Threat scope reduction.

shady23 👍 1 Selected: D

D. Threat scope reduction Threat scope Reduction. Limit the users' access to only what they need for their work tasks because this drastically reduces the network's potential attack surface.

f71cbb0 👍 1 Selected: A

Correct answer is A. B,C,D are under control plane

Luchis_69 👍 2 Selected: D

A is wrong because secured zones may be a component of network segmentation, which is indeed an important aspect of Zero Trust architecture. However, while secured zones help enforce segmentation and isolation between different parts of the network, they do not directly address the goal of minimizing the scope of potential threats within the data plane itself. Therefore, while important, secured zones may not be the most relevant aspect to evaluate when specifically considering the implementation of Zero Trust principles within the data plane.

MAKOhunter33333333 👍 1 Selected: A

It asks about the Data plane not the control plane, which includes implicit trust zones, systems and subjects, and policy enforcement points

An381038 👍 2 Selected: D

D. Threat scope reduction Zero Trust principles advocate for a security model where no implicit trust is granted to users, devices, or processes based solely on their physical or network location. Option A, "Secured zones" When evaluating Zero Trust principles within the data plane specifically, the focus is more on how data is handled, protected, and accessed rather than on physical or logical network segmentation.

shady23 👍 3 Selected: C

While securing zones is indeed important for maintaining a secure environment, Zero Trust principles extend beyond traditional perimeter-based security models, focusing on continuous verification and strict access controls regardless of network location. However, in the context of evaluating the implementation of Zero Trust principles within the data plane, the emphasis is on ensuring that access control mechanisms are dynamically applied based on contextual factors, such as user behavior and device posture, rather than relying solely on predetermined network zones. Therefore, while secured zones are relevant to overall security architecture, the most pertinent aspect for an analyst evaluating the implementation of Zero Trust principles within the data plane would still be

Yoez 👍 4

for me is B

Lienx 👍 2 Selected: D

One of the key principles of Zero Trust is to assume breach and minimize the blast radius and segment access. This means that the network should be divided into smaller and isolated segments or zones, each with its own security policies and controls. This way, if one segment is compromised, the attacker cannot easily move laterally to other segments and access more resources or data. This principle is also known as threat scope reduction, as it reduces the scope and impact of a potential threat.

Mehsotopes 👍 2 Selected: A

Your number one goal is to ensure the area of work is as secure as possible with constant evaluation, & not for the purpose of a specific subject role, or identity. Threats are already meant to be reduced in a secure area.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

In CompTIA's Zero Trust model the data plane is where enforcement of already-defined policy actually happens on subjects and systems, and "subject role" is the only option drawn from that side of the architecture. The data plane comprises the subject/system, the policy engine, the policy administrator, and the policy enforcement point, all of which act on the identity and role a subject presents. Because the question explicitly asks about implementation "within the data plane," the analyst must evaluate a data plane element, and subject role is exactly that. The remaining three options are all catalogued under the control plane, which defines and manages policy rather than enforcing it. Therefore B is the defensible answer on the wording of the question alone.

Why the Other Options Are Wrong

Secured zones (A), adaptive identity (C), and threat scope reduction (D) form the control plane triad plus secured zones in CompTIA's Zero Trust breakdown, and they are all about defining trust boundaries and policy, not about enforcing it on a subject. Adaptive identity is the control plane's continuous evaluation of user and device signals to set risk-based policy, and threat scope reduction is the strategy of shrinking the attack surface by removing implicit trust in the control plane. Secured zones are isolated environments established by that policy layer, so they are the control plane's output rather than a data plane actor. Choosing A simply because "zones" sit close to traffic confuses where policy is authored with where it is applied.

Community Comment Notes

Most learners split the topic correctly: pedrwc7 posted a compact mapping — "Secured Zone = Control Plane Subject Role = Data Plane" — and AutoroTink cited a training source giving control plane as adaptive identity, threat scope reduction, policy-driven access control, and secured zones, and data plane as subject/system, policy engine, policy administrator, and policy enforcement points. As kinny4000 noted, subjects are the only listed principle strongly tied to the data plane, and every other option applies to the control plane or to Zero Trust generally. The 38-to-37 vote split with secured zones is a reminder that popularity is not evidence; SHADTECH123's argument for A rests on micro-segmentation, which is a control plane function. Nothing in the comments successfully relocates secured zones into the data plane, so the B camp has the stronger position even though it barely leads the poll.

Official Reference

Exam Strategy

Anchor Zero Trust questions with a two-column mental list: control plane = adaptive identity, threat scope reduction, policy-driven access control, secured zones; data plane = subject/system, policy engine, policy administrator, policy enforcement point. When the stem names a plane, match the option to that column before reading further, and never let a term that sounds network-oriented pull you sideways.

Frequently Asked Questions

Why is secured zones wrong here if it is also part of Zero Trust?

Secured zones sit in the control plane of CompTIA's Zero Trust model. The data plane contains the subject/system plus the policy engine, policy administrator, and policy enforcement point.

What exactly belongs to the Zero Trust data plane?

Subject/system, policy engine, policy administrator, and policy enforcement point. The analyst evaluates the subject's role because that is what the policy is enforced against.

More SY0-701 FAQ →

Related Analysis

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide