CompTIA Security+ Subdomain 1.2: Zero Trust, Physical Security, and Deception Technology Study Guide

Zero Trust Architecture (ZTA)

  • The Foundational Principle: The core philosophy of Zero Trust Architecture is "Never Trust, Always Verify."
  • Traditional vs. Modern Security Assumptions:
    • Traditional Security: Assumes that anything or anyone inside the network perimeter is safe and trustworthy.
    • Zero Trust: Rejects the assumption of automatic trust for any user or device, regardless of whether they are inside or outside the network. Every request must be checked every single time.
  • Organizational Planes: Zero Trust is logically divided into two primary planes of operation:
    • Control Plane: This is the decision-making side of the architecture. It evaluates the security context and determines whether a request should be allowed.
    • Data Plane: This is where access actually occurs and where the decisions made by the Control Plane are carried out.

Control Plane Components and Concepts

  • Adaptive Identity:
    • Definition: Authentication that dynamically adjusts based on context.
    • Contextual Factors: Location (e.g., is the user in a new country?), device health (e.g., is the OS patched?), and behavior patterns (e.g., is the login happening at 3 AM?).
  • Threat Scope Reduction:
    • Definition: Limiting the reach of a user or device within the network.
    • Purpose: Ensuring that if a breach occurs, the attacker or the compromised account cannot move laterally through the network easily.
  • Policy-Driven Access Control:
    • Definition: Access decisions are strictly governed by pre-defined policies rather than the simple assumption that "they are already logged in."
  • Policy Engine (The "Brain"):
    • Functional Role: The component that decides whether to grant, deny, or revoke access to a resource based on the established security policy.
  • Policy Administrator:
    • Functional Role: The component responsible for physically opening or shutting down the communication path between the subject and the resource. It executes the orders provided by the Policy Engine.

Data Plane Components and Concepts

  • Subject/System: The specific user or device that is requesting access to a resource.
  • Policy Enforcement Point (PEP) (The "Gatekeeper"):
    • Functional Role: This is the point where the connection is actually granted or blocked. It carries out the decision transmitted from the Policy Engine/Administrator.
  • Implicit Trust Zones:
    • Definition: These are areas of the network where trust is assumed.
    • Zero Trust Goal: The objective of ZTA is to shrink these zones as much as possible until they are virtually non-existent.
  • The Full Chain of a Request (In order of execution):
    1. Subject requests access.
    2. Policy Engine evaluates the request and makes a decision.
    3. Policy Administrator opens the communication path.
    4. Policy Enforcement Point (PEP) allows the connection through to the resource.
  • Exam Tip: Remember that the Control Plane decides, while the Data Plane enforces.
  • Professional Connection: A Zero Trust Architect or Network Security Engineer is responsible for designing and implementing these policies across an organization.

Physical Security Controls

  • General Concept: Physical security controls protect physical buildings, equipment, and biological people from tangible threats, ranging from burglary to vehicle-based attacks.
  • Specific Controls and Definitions:
    • Bollards: Short, sturdy, concrete or steel posts designed to block vehicles from ramming into a building or sensitive area.
    • Access Control Vestibule: A small, enclosed entry area consisting of two doors where only one person can pass through at a time. Its primary purpose is to prevent "tailgating" (when an unauthorized person follows an authorized person through a door).
    • Fencing: A physical perimeter barrier installed around a property.
    • Video Surveillance: Cameras used to monitor and record activity for detection and evidence.
    • Security Guard: Human personnel who actively monitor and control access to a facility.
    • Access Badge: A physical card (or digital equivalent) used to electronically unlock doors via readers.
    • Lighting: Illumination used to deter intruders by eliminating hiding spots and making motion more visible.

Specialized Physical Sensor Types

  • Infrared Sensors: Detect motion or presence by sensing body heat.
  • Pressure Sensors: Detect weight or movement on a surface, such as sensors placed under floor mats or floor panels.
  • Microwave Sensors: Detect motion by emitting and receiving microwave pulses.
  • Ultrasonic Sensors: Detect motion by utilizing sound waves and measuring the reflection.
  • Professional Connection: A Physical Security Specialist or Facilities Security Manager designs these layers, often in collaboration with IT security departments.

Deception and Disruption Technology

  • The Big Idea: Unlike prevention tools that try to stop an attacker from entering, these tools are designed to lure, detect, and study attackers already attempting to gain entry.
  • Honeypot: A fake system (like a decoy server) designed to look like a high-value target. It lures attackers away from real production assets while security teams observe their techniques.
  • Honeynet: An entire network of interconnected honeypots used to simulate a more complex, realistic environment for an attacker to explore.
  • Honeyfile: A fake file, often given a tempting name like "passwords.xlsx" or "Executive_Salaries.xlsx," planted in a system. If it is manipulated (opened or copied), it triggers an immediate alert.
  • Honeytoken: A piece of fake data, such as a dummy API key or fake user credential. If this token is used anywhere in the world, it signals that a breach has occurred.
  • Exam Tip: Deception tools focus on detection and information gathering, not on blocking or prevention. They "catch the attacker in the act."
  • Professional Connection: Threat Intelligence Analysts or Threat Hunters utilize these tools to understand attacker behavior.

Comprehensive Glossary - Quick Reference

  • Zero Trust: Security model based on "Never Trust, Always Verify."
  • Control Plane: The decision-making side of ZTA (Engine, Administrator).
  • Data Plane: The enforcement side of ZTA (PEP).
  • Adaptive Identity: Identity verification that changes based on context.
  • Threat Scope Reduction: Restricting lateral movement during a breach.
  • Policy-Driven Access Control: Rules-based access decisions.
  • Policy Administrator: Executioner of the Policy Engine's outcome.
  • Policy Engine: The decision logic of ZTA.
  • Implicit Trust Zone: Traditionally "safe" areas ZTA seeks to eliminate.
  • Subject/System: The requester of access.
  • Policy Enforcement Point (PEP): The gatekeeper for access requests.
  • Bollards: Vehicle barriers.
  • Access Control Vestibule: Man-trap used to stop tailgating.
  • Fencing: Perimeter security.
  • Infrared Sensor: Heat-based detection.
  • Pressure Sensor: Weight-based detection.
  • Microwave Sensor: Pulse-based detection.
  • Ultrasonic Sensor: Sound-wave-based detection.
  • Honeypot: Individual decoy system.
  • Honeynet: Decoy network.
  • Honeyfile: Decoy file.
  • Honeytoken: Decoy data.

Practice Questions and Application Scenarios

Section A: Recall-Level Questions

  • A1. What is the core principle behind Zero Trust?
    • a) Trust users inside the network, verify users outside it
    • b) Never trust automatically — verify every request, every time
    • c) Trust is granted once and never re-checked
    • d) Only technical controls matter, not policies
  • A2. In Zero Trust, which component makes the actual decision to grant or deny access?
    • a) Policy Enforcement Point
    • b) Policy Administrator
    • c) Policy Engine
    • d) Subject/System
  • A3. Which Zero Trust component actually carries out (opens or closes) the communication path?
    • a) Policy Engine
    • b) Policy Administrator
    • c) Subject/System
    • d) Implicit trust zone
  • A4. What is the purpose of an access control vestibule?
    • a) To provide lighting at night
    • b) To allow only one person through at a time and prevent tailgating
    • c) To detect motion using sound waves
    • d) To lure attackers into a fake system
  • A5. What is a honeypot?
    • a) A real production server with extra security
    • b) A fake system designed to lure and study attackers
    • c) A type of physical sensor
    • d) A written security policy
  • A6. Which sensor type detects motion using sound waves?
    • a) Infrared
    • b) Pressure
    • c) Microwave
    • d) Ultrasonic

Section B: Applied Scenario Questions (Exam-Style)

  • B1. A remote employee’s request to access a file is evaluated based on their device health, login location, and behavior pattern before access is granted — even though they are using a company-issued laptop. What Zero Trust concept is being applied?
    • a) Implicit trust zone
    • b) Adaptive identity
    • c) Policy Enforcement Point
    • d) Honeytoken
  • B2. An organization limits a compromised user account so it can only reach one file share instead of the entire network. What Zero Trust concept does this describe?
    • a) Policy Administrator
    • b) Threat scope reduction
    • c) Data Plane
    • d) Subject/System
  • B3. A data center uses short, sturdy concrete posts around its perimeter to prevent a vehicle from ramming into the building. What physical control is this?
    • a) Fencing
    • b) Bollards
    • c) Access control vestibule
    • d) Lighting
  • B4. A security team plants a fake spreadsheet named ‘Executive_Salaries.xlsx’ on a shared drive to detect unauthorized snooping. If anyone opens it, an alert fires. What is this an example of?
    • a) Honeypot
    • b) Honeynet
    • c) Honeyfile
    • d) Honeytoken
  • B5. A security team plants a fake API key in a code repository. If that specific key is ever used to log in, it immediately signals a breach. What is this an example of?
    • a) Honeypot
    • b) Honeynet
    • c) Honeyfile
    • d) Honeytoken
  • B6. A company sets up an entire simulated network — fake servers, fake workstations, fake file shares — to study how attackers move once inside. What is this an example of?
    • a) Honeypot
    • b) Honeynet
    • c) Honeyfile
    • d) Honeytoken
  • B7. A sensor in a server room detects an intruder by sensing body heat. What TYPE of sensor is this?
    • a) Infrared
    • b) Pressure
    • c) Microwave
    • d) Ultrasonic
  • B8. A former employee’s badge still works, and they’re able to enter the building undetected weeks after leaving. Which physical security process most likely failed?
    • a) Fencing
    • b) Badge/access deactivation upon offboarding
    • c) Video surveillance
    • d) Lighting

Section C: Open-Ended / Discussion Questions

  • C1. Explain, in your own words, why Zero Trust doesn’t automatically trust a device just because it’s already inside the company network. Can you think of a situation where ‘implicit trust’ caused a real-world problem?
  • C2. Compare a honeypot to a traditional firewall. Why might a security team want an attacker to get in, rather than just keeping them out?
  • C3. Design a layered physical security plan for a small server room using at least four different controls. Explain what each layer adds that the others don’t.
  • C4. Walk through the full Zero Trust chain in your own words, from a user’s request to a granted connection. Where would a stolen password get stopped in this chain, and why?