Which Zero Trust Component Belongs to the Data Plane?

SY0-701 By islever Editorial Last updated

Summarize fundamental security concepts.

Short answer

B Subject role is the Zero Trust data plane element; secured zones, adaptive identity, and threat scope reduction are all control plane components.

Question

An analyst is evaluating the implementation of Zero Trust principles within the data plane. Which of the following would be most relevant for the analyst to evaluate?
  1. Secured zones
  2. Subject role Correct Answer
  3. Adaptive identity
  4. Threat scope reduction

Key Takeaways

The question tests whether you can map Zero Trust components onto the control plane versus the data plane, and the trap is picking "secured zones" because network segmentation sounds like it handles data traffic rather than policy definition.

Zero Trust separates its architecture into a control plane and a data plane, and the SY0-701 exam expects candidates to know which component lives where. This page establishes that subject role (B) is the data plane element, while secured zones, adaptive identity, and threat scope reduction are control plane constructs.

Common mistake: Choosing A (secured zones) is the most common error: micro-segmentation feels like a data plane activity to many learners, but CompTIA defines secured zones as part of the control plane alongside adaptive identity and threat scope reduction.

Expert Analysis

Why the Answer Is Correct

In CompTIA's Zero Trust model the data plane is where enforcement of already-defined policy actually happens on subjects and systems, and "subject role" is the only option drawn from that side of the architecture. The data plane comprises the subject/system, the policy engine, the policy administrator, and the policy enforcement point, all of which act on the identity and role a subject presents. Because the question explicitly asks about implementation "within the data plane," the analyst must evaluate a data plane element, and subject role is exactly that. The remaining three options are all catalogued under the control plane, which defines and manages policy rather than enforcing it. Therefore B is the defensible answer on the wording of the question alone.

Why the Other Options Are Wrong

Secured zones (A), adaptive identity (C), and threat scope reduction (D) form the control plane triad plus secured zones in CompTIA's Zero Trust breakdown, and they are all about defining trust boundaries and policy, not about enforcing it on a subject. Adaptive identity is the control plane's continuous evaluation of user and device signals to set risk-based policy, and threat scope reduction is the strategy of shrinking the attack surface by removing implicit trust in the control plane. Secured zones are isolated environments established by that policy layer, so they are the control plane's output rather than a data plane actor. Choosing A simply because "zones" sit close to traffic confuses where policy is authored with where it is applied.

Community Comment Notes

Most learners split the topic correctly: pedrwc7 posted a compact mapping — "Secured Zone = Control Plane Subject Role = Data Plane" — and AutoroTink cited a training source giving control plane as adaptive identity, threat scope reduction, policy-driven access control, and secured zones, and data plane as subject/system, policy engine, policy administrator, and policy enforcement points. As kinny4000 noted, subjects are the only listed principle strongly tied to the data plane, and every other option applies to the control plane or to Zero Trust generally. The 38-to-37 vote split with secured zones is a reminder that popularity is not evidence; SHADTECH123's argument for A rests on micro-segmentation, which is a control plane function. Nothing in the comments successfully relocates secured zones into the data plane, so the B camp has the stronger position even though it barely leads the poll.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Anchor Zero Trust questions with a two-column mental list: control plane = adaptive identity, threat scope reduction, policy-driven access control, secured zones; data plane = subject/system, policy engine, policy administrator, policy enforcement point. When the stem names a plane, match the option to that column before reading further, and never let a term that sounds network-oriented pull you sideways.

Frequently Asked Questions

Why is secured zones wrong here if it is also part of Zero Trust?

Secured zones sit in the control plane of CompTIA's Zero Trust model. The data plane contains the subject/system plus the policy engine, policy administrator, and policy enforcement point.

What exactly belongs to the Zero Trust data plane?

Subject/system, policy engine, policy administrator, and policy enforcement point. The analyst evaluates the subject's role because that is what the policy is enforced against.

More SY0-701 FAQ →

Community Votes

B
41%
A
40%
D
18%

41% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 58 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 30 of 58

  1. SHADTECH123 👍 27 Answered A
    A. Secured Zones Explanation: In the context of implementing Zero Trust principles within the data plane, secured zones are most relevant. Zero Trust principles emphasize the need to eliminate implicit trust and enforce strict access controls. By evaluating and implementing secured zones, an organization can ensure that data is compartmentalized and that access is tightly controlled, aligning with the core tenets of Zero Trust. This approach helps to contain threats and limit lateral movement within the network, providing a strong foundation for a Zero Trust architecture.
  2. AutoroTink 👍 20 Answered B
    From Dion Training: Control Plane: Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control, and secured zones. Data Plane: Subject/system, policy engine, policy administrator, and establishing policy enforcement points. (I've also been trying to verify this from other locations...it's been a challenge!)
  3. pedrwc7 👍 5 Answered B
    A. Secured zones (Control Plane) B. Subject role (Data Plane) C. Adaptive identity (Control Plane) D. Threat scope reduction (Control Plane)
  4. kinny4000 👍 4 Answered B
    Subjects are the only principle associated strongly with the data plane, everything else applies more to the control plane or zero trust in general. The question says "WITHIN the data plane"
  5. Gominolo 👍 4 Answered B
    B. Subject Subject is one of the core components of the Data plane
Show 25 more comments
  1. shady23 👍 3 Answered C
    While securing zones is indeed important for maintaining a secure environment, Zero Trust principles extend beyond traditional perimeter-based security models, focusing on continuous verification and strict access controls regardless of network location. However, in the context of evaluating the implementation of Zero Trust principles within the data plane, the emphasis is on ensuring that access control mechanisms are dynamically applied based on contextual factors, such as user behavior and device posture, rather than relying solely on predetermined network zones. Therefore, while secured zones are relevant to overall security architecture, the most pertinent aspect for an analyst evaluating the implementation of Zero Trust principles within the data plane would still be
  2. PAWarriors 👍 3 Answered B
    Correct answer should be B. Control Plane: Refers to the overarching framework and set of components responsible for defining, managing, and enforcing the policies related to user and system access within an organization. Control Plane typically encompasses several key elements --> Adaptive Identity, Threat Scope Reduction, Policy-Driven Access Control and Secured Zones (Isolated environments within a network that are designed to house sensitive data). Data Plane: Ensures the policies are properly executed and consists of the following --> Subject/System (Refers to the individual or entity attempting to gain access), Policy Engine, Policy Administrator and Policy Enforcement Point.
  3. dbrowndiver 👍 3 Answered A
    In this scenario, the analyst is evaluating Zero Trust principles specifically within the data plane. The data plane in network architecture refers to the part of a network that carries user data, as opposed to the control plane, which manages network functions. Implementing Zero Trust in the data plane focuses on securing data access and communication.
  4. TestingSun42 👍 3 Answered B
    Secured Zone = Control Plane Subject Role = Data Plane Check the study guide to conform this for yourself
  5. Etc_Shadow28000 👍 2 Answered A
    Answer A. Secured zones Zero Trust principles advocate for continuous verification of users and devices, and the segmentation of networks into smaller, secure zones to reduce the attack surface. This means evaluating how well the data plane is segmented into secured zones, ensuring that sensitive data is accessed only by authenticated and authorized users and devices, and that lateral movement within the network is restricted. - B This pertains more to identity and access management, ensuring that roles and permissions are correctly assigned and managed. - C This involves dynamically adjusting identity verification based on context and behavior, which is more relevant to authentication and access control rather than the data plane. - D This is a broad concept that involves minimizing the potential impact of threats, which can be achieved through various means, including secured zones, but is not specific to the data plane.
  6. TheMichael 👍 2 Answered D
    I thought you guys might appreciate some clarification on this. The question asks what zero-trust principle the the analyst should focus on within the data plane. Zero Trust in the Data Plane: In the data plane, Zero Trust focuses on securing the data itself, minimizing the potential damage caused by unauthorized access, even if lateral movement occurs. So it's not (A.) because Secured zones are in the control plane. It's not (B.) because b is not a principle of the data plane but rather a component. It's not (C.) because that's part of the control plane The answer is most likely (D.) because it's a principle of zero trust that directly applies to the data plane. What about this answer reduces threat scope within the data plane? -Data encryption -access controls at the data level -minimizing data access These all contribute to threat scope reduction within the data plane.
  7. braveheart22 👍 2 Answered D
    Zero Trust focuses on the principle of "never trust, always verify," and it emphasizes minimizing the attack surface and reducing the scope of potential threats. Within the data plane (which handles the flow of data across a network), threat scope reduction is particularly important because it involves minimizing access to data and services based on strict verification and least-privilege principles. Threat scope reduction is a critical component of Zero Trust because it reduces the areas within a network where threats could potentially spread, making it harder for malicious actors to move laterally within the environment. It limits access to only what is necessary for each user or service, ensuring that any compromised component doesn’t expose unnecessary parts of the system.
  8. noragami 👍 2
    The most relevant aspect for an analyst to evaluate when implementing Zero Trust principles within the data plane would be: A. Secured zones Zero Trust principles emphasize the importance of securing all communication and data transactions within the network. Implementing secured zones involves segmenting the network into smaller, isolated sections to minimize the risk of unauthorized access and lateral movement of threats. This is crucial in the data plane, where data is actively processed and transferred, as it ensures that each zone is tightly controlled and monitored, adhering to Zero Trust's "never trust, always verify" approach.
  9. babujiju 👍 2 Answered A
    The most relevant choice for evaluating the implementation of Zero Trust principles within the data plane is: A. Secured zones Explanation: Secured zones align closely with the Zero Trust principle of micro-segmentation. In the data plane, creating and enforcing secured zones means that traffic between different parts of the network is strictly controlled and inspected. This minimizes lateral movement of threats and ensures access is limited to authorized users and devices. It focuses on isolating resources and enforcing policies at a granular level, which is a core tenet of Zero Trust.
  10. Luchis_69 👍 2 Answered D
    A is wrong because secured zones may be a component of network segmentation, which is indeed an important aspect of Zero Trust architecture. However, while secured zones help enforce segmentation and isolation between different parts of the network, they do not directly address the goal of minimizing the scope of potential threats within the data plane itself. Therefore, while important, secured zones may not be the most relevant aspect to evaluate when specifically considering the implementation of Zero Trust principles within the data plane.
  11. Lienx 👍 2 Answered D
    One of the key principles of Zero Trust is to assume breach and minimize the blast radius and segment access. This means that the network should be divided into smaller and isolated segments or zones, each with its own security policies and controls. This way, if one segment is compromised, the attacker cannot easily move laterally to other segments and access more resources or data. This principle is also known as threat scope reduction, as it reduces the scope and impact of a potential threat.
  12. KelvinYau 👍 2 Answered D
    Secured zones are a concept related to the control plane, which is the part of the network that makes routing and switching decisions. Subject role is a concept related to the identity plane, which is the part of the network that authenticates and authorizes users and devices. Adaptive identity is a concept related to the policy plane, which is the part of the network that defines and enforces the security policies and rules.
  13. An381038 👍 2 Answered D
    D. Threat scope reduction Zero Trust principles advocate for a security model where no implicit trust is granted to users, devices, or processes based solely on their physical or network location. Option A, "Secured zones" When evaluating Zero Trust principles within the data plane specifically, the focus is more on how data is handled, protected, and accessed rather than on physical or logical network segmentation.
  14. Olaunfazed 👍 2 Answered B
    When evaluating the implementation of Zero Trust principles within the data plane, the primary focus is on ensuring that access to data is tightly controlled based on who the subject is (identity), their role, and their permissions. Zero Trust principles require constant verification of the subject's role and access rights before allowing data access, emphasizing least privilege and context-aware decision-making.
  15. c7b3ff0 👍 2 Answered B
    B because... Zero Trust occurs in the DATA plane (which the question is asking for) and the CONTROL plane (which it is not asking for). Control Plane: Adaptive identity, Threat Scope Reduction, Policy-Driven Access Control, Secured Zones Data Plane: Subject/system, policy engine, policy administrator, and establishing policy encforcement plans Subject is the only answer, it's not A, A is control plane.
  16. chadbigman 👍 2 Answered C
    Adaptive identity is about continuously evaluating and adapting permissions based on the context and risk. This aligns closely with Zero Trust principles, which require dynamic, context-aware, and continuous verification of identity and access.
  17. Mehsotopes 👍 2 Answered A
    Your number one goal is to ensure the area of work is as secure as possible with constant evaluation, & not for the purpose of a specific subject role, or identity. Threats are already meant to be reduced in a secure area.
  18. camillejonessm 👍 2 Answered B
    Subject Roles affect data planes
  19. oldbutgold 👍 1 Answered D
    Control Plane: Manages policies, including Adaptive Identity, Policy-Driven Access Control, Threat Scope Reduction, and the Policy Decision Point. (Source: CompTIA official guide - Latest) Data Plane: Implements the policies set by the control plane and includes Subject (user/device), Policy Enforcement Points, and Implicit Trusted Zones Source: CompTIA official guide - Latest) The question specifically asks about implementing Zero Trust principles in the data plane. The role of a subject (B) is part of the data plane, but it does not define how Zero Trust is implemented. Instead, Threat Scope Reduction (D) ensures that subject access is restricted to the minimum necessary resources, which is a key principle in the data plane.
  20. ItAd 👍 1 Answered B
    Zero Trust principles within the data plane focus on enforcing strict access controls to ensure that only authorized entities (subjects) can access specific data resources. Evaluating subject roles aligns with Zero Trust because: Least Privilege Access: Zero Trust enforces the principle of least privilege, meaning that access to data is granted based on predefined roles and responsibilities. Role-Based Access Control (RBAC): Subject roles define what actions a user, service, or device can perform on data within the data plane. Continuous Verification: Access is granted dynamically based on role, identity, and other contextual factors (e.g., device security posture or network conditions).
  21. MLKTKN 👍 1
    The most relevant option for evaluating the implementation of Zero Trust principles within the data plane would be: A. Secured zones Explanation: In a Zero Trust model, "secured zones" involve segmenting and isolating data and resources to minimize unauthorized access and limit the lateral movement of threats. This approach aligns with the core Zero Trust principle of assuming no implicit trust and enforcing strict access controls within the data plane. By focusing on secured zones, the analyst would be evaluating how data and resources are isolated and protected within the network, ensuring that sensitive areas are protected and access is tightly controlled.
  22. Dimpo_Oz 👍 1 Answered C
    Adaptive Identity (C): Zero Trust principles emphasize continuous authentication and authorization based on real-time context and behavior. Adaptive identity refers to the dynamic adjustment of access control based on factors such as the user's identity, location, device health, and behavior patterns. This is highly relevant in the data plane as it ensures that even after initial authentication, access is continuously reassessed based on changing conditions, aligning with Zero Trust's goal of not trusting any entity, inside or outside the network, by default.
  23. Rackup 👍 1 Answered D
    Answer: D. Threat scope reduction Explanation: Threat scope reduction is most relevant when evaluating the implementation of Zero Trust principles, as Zero Trust focuses on minimizing the attack surface and reducing the scope of potential threats. This involves continuously verifying access and limiting user and device access based on the least privilege principle. By evaluating threat scope reduction, the analyst can ensure that resources are only accessible based on the minimal necessary access, which is a core tenet of Zero Trust architecture.
  24. Oluwatobi4880 👍 1 Answered B
    When evaluating the implementation of Zero Trust principles within the data plane, the most relevant factor for an analyst to evaluate would be: B. Subject role It is crucial to assess how roles and identities are managed and enforced to ensure secure access and control within the Zero Trust framework. By focusing on subject roles, the analyst can determine how access controls and permissions are applied to users, ensuring that only the right individuals have access to the necessary data, consistent with the principles of Zero Trust.
  25. KSoLL 👍 1 Answered B
    B. Subject role Keywords in this question is [Data plane] & [Zero Trust] The control plane layout the policies and procedures Control plane typically encompasses several key elements: 1. Adaptive identity 2. Threat Scope Reduction 3. Policy-Driven Access Control 4.Secured Zones The data plane is going to ensure that the policies properly executed Data planes consists of: 1. Subject/System 2. Policy Enforcement Point I got this information from Jason Dion videos [Section 2: Fundamentals of Security - 15. Zero Trust (OBJ 1.2)

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

CCTV and Surveillance Signs as Security Controls

S-grade

When Should an Engineer Decommission a Network Device?

S-grade

Which Controls Secure Remote Access to Sensitive PHI Applications?

S-grade

What Risk Does Opening Firewall Ports for a SaaS System Introduce?

S-grade

Practice All SY0-701 Questions

Access 100 questions with complete answers and detailed explanations.

View Full SY0-701 Practice Test →

← Back to SY0-701 Study Guide