thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Security Fundamentals & Crypto · Advanced

Zero Trust Control Plane

The zero trust layer where policy decisions are made, separate from the data plane where traffic flows.

Definition

The control plane includes the policy engine, policy administrator, and adaptive identity and threat analysis components. The data plane contains subjects, PEPs, and resources, carrying actual application traffic. Separating them lets policy be centrally managed and protected.

Example

A SASE provider's cloud console and policy engine form the control plane, while its points of presence enforce traffic in the data plane.

Exam tip

Security+ objectives split zero trust into control plane (adaptive identity, threat scope reduction, policy-driven access control, PE/PA) and data plane (implicit trust zones, subject/system, PEP).

Related terms