SY0-701 Question 18

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A1

  The best answer is: ✅ A. Secured zones Why? In a Zero Trust Architecture, the data plane is concerned with where traffic, resources, and workloads exist and how they are segmented and protected. Secured zones (sometimes called micro-segments or protected segments) are part of the data plane because they define how resources are isolated and how access is controlled between them. Why the others are less appropriate B. Subject role Relates to identity and access management (IAM). More associated with the identity plane and access decisions. C. Adaptive identity Refers to dynamically adjusting authentication requirements based on risk. Also belongs primarily to the identity/authentication aspects of Zero Trust. D. Threat scope reduction This is a goal or outcome of Zero Trust, not a specific data-plane component.

• Chose D1

  Why D is correct: In the Zero Trust architecture, the data plane (also known as the data flow) refers to the actual movement of data and the enforcement of policies on that traffic. Threat scope reduction is the primary outcome of effectively implementing Zero Trust in the data plane. By segmenting traffic, enforcing least-privilege access, and continuously verifying every request, the organization minimizes the lateral movement an attacker can achieve. Evaluating how well the data plane restricts access and limits the blast radius of a breach is the most direct way to assess the implementation of Zero Trust principles in this context.

• Chose A2

  A. Secured Zones Explanation: In the zero trust arch model, the data plane is where the actual traffic flows and where enforcement happens which includes concepts like secured/segmented zones, the subject/system being evaluated, the policy enforcement point, and implicit trust zones. SECURED ZONES describe how the network is segmented into distinct areas of trust, which is a core data plane consideration for actually enforcing access controls on traffic