Which statement describes a defense-in-depth approach?

Which statement describes a defense-in-depth approach?

• A. It relies on multiple layers of controls across people, processes, and technology.
• B. It relies on a single firewall to protect all assets.
• C. It eliminates the need for human security oversight.
• D. It makes all detections automatic without monitoring.

Answer: (A)

Defense in depth means applying multiple security controls across people, processes, and technology so that if one layer fails, others still protect assets. This layered approach creates redundancy and reduces the chance that a single vulnerability leads to a breach, while also providing a broader range of detection and response capabilities. By combining user training and policy with access controls and incident response, along with technical measures like firewalls, monitoring, encryption, and patch management, an organization builds overlapping protections that cover different angles of risk. The statement reflects this approach by emphasizing multiple layers of controls across people, processes, and technology. Relying on a single firewall does not provide layering, so it doesn’t fit defense in depth. Eliminating human security oversight ignores the essential roles of policies, training, and incident response. Making all detections automatic without monitoring misses the need for ongoing human and automated review to interpret alerts and respond effectively.

Defense in depth means applying multiple security controls across people, processes, and technology so that if one layer fails, others still protect assets. This layered approach creates redundancy and reduces the chance that a single vulnerability leads to a breach, while also providing a broader range of detection and response capabilities. By combining user training and policy with access controls and incident response, along with technical measures like firewalls, monitoring, encryption, and patch management, an organization builds overlapping protections that cover different angles of risk. The statement reflects this approach by emphasizing multiple layers of controls across people, processes, and technology.

Relying on a single firewall does not provide layering, so it doesn’t fit defense in depth. Eliminating human security oversight ignores the essential roles of policies, training, and incident response. Making all detections automatic without monitoring misses the need for ongoing human and automated review to interpret alerts and respond effectively.