Within the Five-Step Methodology of Zero Trust, in which step would application access and user access be defined?

Within the Five-Step Methodology of Zero Trust, in which step would application access and user access be defined?
A . Step 3: Architect a Zero Trust Network
B. Step 5. Monitor and Maintain the Network
C. Step 4: Create the Zero Trust Policy
D. Step 1: Define the Protect Surface
E. Step 2 Map the Protect Surface Transaction Flows

Answer: D