Zero trust, and the deception technology that sits beside it

Objective 1.2 in this course covers fundamental concepts. The previous lesson took CIA, AAA and non-repudiation; this one takes the other two items in CompTIA's scope note for it — zero trust, and deception and disruption technology.

Why this matters

Zero trust is the single most vocabulary-heavy item in Domain 1. CompTIA examines it with named components — control plane, data plane, policy engine, policy administrator, policy enforcement point, adaptive identity, threat scope reduction, policy-driven access control, implicit trust zones — and questions tend to hand you a description and want the component's name back. That is pure recall, it is entirely learnable, and people lose the marks because they revised "zero trust means never trust, always verify" and stopped.

Deception technology is much smaller and appears far less often, but it is easy marks: four terms, four clear distinctions.

The lesson

Why the perimeter model fails once the attacker is already inside

The traditional model draws a boundary, puts controls on it, and treats everything inside as trusted. It fails for three reasons the exam expects you to be able to state.

• There is no longer one inside. Staff work from home, workloads run in three clouds, and partners have connections into your estate. The perimeter encloses a fraction of what matters.
• The first compromise is usually a person, not the firewall. Phishing delivers an attacker into the trusted zone, where the perimeter controls are behind them and pointing the wrong way.
• Lateral movement is cheap once inside. Flat internal networks and reused credentials mean one workstation becomes the domain.

Zero trust's answer is to stop granting trust by location. Every request is authenticated and authorised on its own merits, regardless of where it came from, and it is re-evaluated rather than granted once for a session.

Control plane and data plane, adaptive identity, policy engine and policy enforcement point

CompTIA splits a zero trust architecture into two planes.

The control plane decides. It contains:

• Adaptive identity — the identity signal is not just "who", it is who, from what device, from where, at what time, with what posture. The same user on a managed laptop in the office and on an unknown phone at 3am are not treated as the same subject.
• Threat scope reduction — shrinking what any one identity can reach, so that a compromise is small. This is least privilege stated as an architectural goal, and it is why microsegmentation belongs to zero trust.
• Policy-driven access control — access decisions come from evaluated policy rather than from static group membership set up years ago.
• The policy engine, which evaluates the policy against the request and produces a decision, and the policy administrator, which communicates that decision and issues or revokes the access token.

The data plane enforces. It contains:

• the subject/system making the request,
• the policy enforcement point — the component that actually allows or blocks the traffic, having been told what to do by the control plane,
• and the implicit trust zone on the far side of it.

The exam's favourite distinction is the last pair: the policy engine decides, the policy enforcement point enforces. If a question describes something evaluating rules, it is the engine. If it describes something sitting in the traffic path letting packets through, it is the enforcement point.

Implicit trust zones, and the subject/system that never gets one

An implicit trust zone is the region a subject reaches once it has passed the enforcement point — inside it, no further checking happens.

Zero trust does not abolish implicit trust zones; it makes them as small as it can. A design where passing one check drops you into the whole corporate network has an enormous implicit trust zone and is barely zero trust at all. A design where the enforcement point brokers access to a single application, and a request for a second application goes back through the control plane, has a tiny one.

That is the practical way to judge an architecture on the exam: ask what a subject can reach after it has been allowed through. The smaller that is, the more genuinely zero trust the design is.

Honeypots, honeynets, honeyfiles and honeytokens, and what each detects

Deception technology puts something attractive and fake where only an attacker would find it, so that touching it is itself the alert.

• A honeypot is a decoy system — a server that looks real, runs plausible services, and holds nothing of value. Nobody has a legitimate reason to connect to it, so any connection is suspicious by definition.
• A honeynet is a whole decoy network of them, which lets you watch an attacker move laterally and see the techniques they use, not just the first touch.
• A honeyfile is a decoy file — passwords.xlsx, payroll_2026.csv — placed on a real share, with an alert wired to any access.
• A honeytoken is a decoy credential or data item — a fake API key, a fake customer record, a fake account — planted so that its use anywhere tells you where your data ended up. A honeytoken appearing in a third party's breach dump tells you which system leaked.

The disruption half of the objective is the active side: deliberately slowing an attacker down. Tarpits that hold connections open, fake DNS responses that send scans to nowhere, and bogus records that waste an attacker's analysis time. The goal is cost, not prevention.

Deception as a detective control, never as a defence on its own

Two cautions the exam does reward.

First, classify it correctly. A honeypot is a detective control. It does not stop anything; it produces a high-confidence signal. Its value is precisely that its false positive rate is close to zero — the signal needs no tuning, because there is no legitimate traffic to separate it from.

Second, know the risk. A honeypot is a real system with real services, sitting on your network, deliberately made attractive. If it is not properly isolated it becomes a genuine foothold rather than a trap, and an attacker who works out they are in one learns something useful about your maturity. Deception buys detection and time. It is never the control that stops the incident, and an exam option offering it as the primary defence is wrong.

What to take into the exam

• The policy engine decides; the policy enforcement point enforces. The control plane is decision, the data plane is traffic.
• Adaptive identity means the context — device, location, time, posture — is part of the identity signal, not just the username.
• Threat scope reduction is the architectural name for least privilege, and it is what microsegmentation delivers.
• Honeypot = system, honeynet = network, honeyfile = file, honeytoken = a credential or record whose use is the alert.
• Deception is detective. Do not pick it as the answer to "how do we prevent…".