RANGER CompTIA Security+ (SY0-701) · chapter 3 of 27
Week 1: Trust nobody (not even Ranger)
In this chapter Objectives 1.2
Objective 1.2
Zero Trust: the control plane
Never trust, always verify
Zero Trust drops the old idea that anything inside the network is safe. Every request to every resource is authenticated, authorized and checked, every time, no matter where it comes from. The architecture splits into two parts: the control plane (where policy is made and decisions are taken) and the data plane (where the traffic actually flows and the decision is enforced).
Exam tip Easy split: control plane = the brains that decide; data plane = the muscle that moves and blocks traffic.
Control plane ideas
Adaptive identity judges a login by its context, not just the password: device health, location, time, IP reputation, the user's role. Odd context means more checks. Threat scope reduction shrinks the attack surface by limiting entry points and giving least-privilege, per-resource access. Policy-driven access control means access rules are written centrally as policy and applied the same way everywhere.
Exam tip A login from a new country triggering extra MFA is adaptive identity, not just "MFA".
Policy Engine and Policy Administrator
The Policy Engine (PE) makes the decision: it weighs policy, identity, device posture and threat intel, then grants, denies or revokes access. The Policy Administrator (PA) carries the decision out: it tells the enforcement point to open or close the path and creates the session credentials or tokens. Together they form what NIST calls the policy decision point.
Subject --> PEP --asks--> PA <--> PE
^ |
+-open/close--+
PE decides grant/deny; PA tells the PEP
Exam tip Trap: PE DEcides (E for Evaluate); PA Administers the decision. Neither one sits in the traffic path; the PEP does.
Objective 1.2
Zero Trust: the data plane
Subjects, zones and the PEP
A subject/system is the user, device or application asking for access. An implicit trust zone is the area past the gate where traffic is trusted for that session, so it should be as small as possible, ideally just the one resource. The Policy Enforcement Point (PEP) is the gatekeeper in the data path: it lets the subject's traffic through or blocks it, following what the PA tells it.
Exam tip Data plane list on the exam: implicit trust zones, subject/system, Policy Enforcement Point. Everything else in the Zero Trust bullets is control plane.
Walk-through
Rosa's tablet asks for the inventory app. The PEP holds the request and asks the PA. The PE checks: is Rosa in the warehouse role, is the tablet managed and patched, is the location normal? Yes: the PA tells the PEP to open a session to that one app. Tomorrow the same check runs again.
Exam tip Why it matters: a stolen password alone no longer opens the network; the device, context and policy must all pass too.
Check yourself 1In a Zero Trust design, which component evaluates the request against policy and decides to grant, deny or revoke access?
- Policy Enforcement Point
- Policy Administrator
- Policy Engine
- Implicit trust zone
Show the answer
Answer: C. Policy Engine
The Policy Engine makes the access decision. The Policy Administrator then tells the PEP to act on it, and the PEP enforces it in the data path.
Objective 1.2
Physical security
Barriers: bollards, fencing, vestibules
Bollards are short posts that stop vehicles from ramming a doorway while letting people walk through. Fencing marks a boundary and keeps people out (height and razor wire increase the strength). An access control vestibule (formerly called a mantrap) is a small room with two doors: usually only one may be open at a time, so one person at a time can be checked and tailgating is stopped.
Exam tip Clue: "stop a car" = bollards. "stop tailgating" or "piggybacking" = access control vestibule.
Eyes and IDs: video, guards, badges, lighting
Video surveillance (CCTV) records and can detect motion or objects. A security guard can make judgment calls, check IDs and respond; two-person integrity/control means two guards are needed so no one person can be compromised. An access badge (often RFID or NFC, with a photo) identifies the holder and logs entry. Lighting deters intruders and makes cameras useful; aim for even light with few shadows.
Exam tip Guards are the only physical control that can think. Badges also give you an audit trail of who entered when.
Sensors
Infrared sensors detect heat (infrared radiation) from a body, used in motion detectors. Pressure sensors detect a change in force, such as a footstep on a floor mat or a window being pushed. Microwave sensors send microwave pulses and detect movement from the reflections; they cover larger areas than infrared. Ultrasonic sensors send high-frequency sound and measure the echo, used for motion and collision detection.
- Infrared = body heat
- Pressure = weight or force
- Microwave = radio reflections, big areas
- Ultrasonic = sound echoes
Exam tip Exam clue: "detects heat signature" = infrared; "detects weight on the floor" = pressure.
Objective 1.2
Deception and disruption technology
Honeypots and honeynets
A honeypot is a fake system built to attract attackers so you can watch their tools and methods while they waste time away from real assets. A honeynet is a larger network of honeypots (servers, workstations, routers) that looks like a real environment.
Exam tip Honeypots have no business purpose, so ANY traffic to one is suspicious. That makes their alerts very low in false positives.
Honeyfiles and honeytokens
A honeyfile is a bait file with a tempting name, like passwords.xlsx, placed on a share; opening it raises an alert. A honeytoken is a traceable piece of fake data: a fake API key, a fake database record, a fake customer email address. If it ever shows up in use or on the internet, you know where the leak came from.
Exam tip Trap: honeyfile = a whole bait file that alerts when opened; honeytoken = a fake data item you can trace when it is used or leaks.
Check yourself 2Priya adds a fake customer, "Biscuit Dogwood", with a unique email address to the shop database. If that address ever gets spam, she knows the database leaked. What is this?
- Honeyfile
- Honeynet
- Honeypot
- Honeytoken
Show the answer
Answer: D. Honeytoken
A fake, traceable data item planted to reveal a leak is a honeytoken. A honeyfile is a whole bait file that alerts when someone opens it.
CompTIA, A+, Network+, Security+ and Linux+ are trademarks of CompTIA, Inc. Ranger Gamez is not affiliated with or endorsed by CompTIA. The practice questions are written to the published exam objectives; they are not real exam questions.