Data flow diagram
A picture of a system's components, the data moving between them and its trust boundaries, used as the surface a threat model is walked across element by element.
Full guide: STRIDE Threat Model Explained: The Six Categories and What They Break for CISSP
A data flow diagram, usually shortened to DFD, maps a system’s components, the data moving between them, and the trust boundaries where the level of trust changes. In threat modeling it is the decomposition step: the artefact that turns an abstract system into something a framework can be applied to part by part.
Four element types make up the vocabulary. An external entity is a person or system outside the boundary of what is being built. A process is something that executes. A data store holds data at rest. A data flow is data in motion between the other three.
The element type is not decoration, because it changes which categories the walk applies. In the STRIDE-per-element matrix, elevation of privilege is assigned to processes rather than to data flows, since gaining rights beyond those granted is a property of something that executes rather than of traffic in transit.
Exam relevance: the diagram is best treated as a prerequisite rather than an optional aid, since STRIDE is applied element by element across it and an analysis performed without one floats free of the architecture it is meant to protect. A scenario describing a team that lists threats without first mapping the system is describing that failure.