What does defense-in-depth mean?

• A. Implementing multiple overlapping controls across people, process, and technology to reduce risk.
• B. Relying on a single firewall
• C. Outsourcing all security
• D. Focusing only on policy documents

Answer: (B)

Defense-in-depth means not relying on a single safeguard, but layering multiple, overlapping controls across people, processes, and technology to reduce risk. When you stack different protections—such as strong authentication (like MFA), least-privilege access, regular patching, data encryption, continuous monitoring, incident response, security training, and physical security—you create multiple barriers. If one control is bypassed or fails, others still stand in the way, making it much harder for threats to succeed. This approach acknowledges that no single control is foolproof and aims to slow or stop attacks at several points.

Relying on a single firewall, outsourcing all security, or focusing only on policy documents don’t provide that layered protection. A single firewall can be bypassed, outsourcing can leave gaps in governance and visibility, and policy alone doesn’t ensure the protective measures are actually implemented or followed.