What is defense in depth?

• A. A single layer of protection
• B. Automatic patch management system
• C. Multiple layers of security controls to protect assets
• D. Security by obscurity

Answer: (C)

Defense in depth means using multiple layers of security controls to protect assets. Rather than relying on a single protection, you mix administrative, technical, and physical measures so if one control is bypassed, others still stand to stop or slow an attack. This approach covers different angles of risk: policy and training to reduce human error, access controls and encryption to protect data, network defenses like firewalls and intrusion detection, monitoring and incident response to detect and respond, and physical security to deter tampering. By layering defenses, you create redundancy and resilience, making it much harder for someone to reach sensitive assets.

The alternatives describe only a single protection, a specific tool or approach, or an idea like security by obscurity that isn’t reliable on its own.