Which statement best describes defense in depth?

Which statement best describes defense in depth?

• A. Zero Trust
• B. Defense in Depth
• C. Least Privilege
• D. Public Key Infrastructure

Answer: (B)

Defense in depth is a strategy that uses multiple, overlapping security controls across different layers so a breach in one area doesn’t compromise the entire system. By guarding at network, host, application, data, and user levels—and combining people, processes, and technology—you create redundancy: if one control fails or is bypassed, others still stand between the attacker and valuable assets. This layered approach also improves detection and response because different controls can alert you at different points in the attack. Zero Trust is about never trusting anything by default and requiring verification for every access request, which is a specific approach within layered security but doesn’t describe the overall strategy of using multiple defenses. Least Privilege focuses on giving users the minimum rights they need, which is one important control in a defense-in-depth stack but not the entire concept. Public Key Infrastructure deals with managing digital certificates and keys for authentication and encryption, a tool used within security systems, not the overarching layered defense concept.

Defense in depth is a strategy that uses multiple, overlapping security controls across different layers so a breach in one area doesn’t compromise the entire system. By guarding at network, host, application, data, and user levels—and combining people, processes, and technology—you create redundancy: if one control fails or is bypassed, others still stand between the attacker and valuable assets. This layered approach also improves detection and response because different controls can alert you at different points in the attack.

Zero Trust is about never trusting anything by default and requiring verification for every access request, which is a specific approach within layered security but doesn’t describe the overall strategy of using multiple defenses. Least Privilege focuses on giving users the minimum rights they need, which is one important control in a defense-in-depth stack but not the entire concept. Public Key Infrastructure deals with managing digital certificates and keys for authentication and encryption, a tool used within security systems, not the overarching layered defense concept.