What is the purpose of a defense-in-depth strategy?

• A. To reduce reliance on any single control and increase resilience against attacks.
• B. To rely on a single powerful control.
• C. To minimize defense layers.
• D. To eliminate monitoring.

Answer: (A)

Defense-in-depth means building security with multiple overlapping layers so protection doesn’t depend on any one control. The purpose is to reduce reliance on a single control and increase resilience against attacks. By combining preventive, detective, and responsive measures across people, processes, and technology—such as strong authentication, access controls, network segmentation, encryption, logging and monitoring, and incident response—you create backups that can block, detect, or limit damage if one layer is bypassed or fails. This layered approach also covers different threat vectors and evolving risks, including misconfigurations or insider threats. Relying on a single powerful control or removing monitoring would leave gaps and reduce visibility, making breaches more likely.