Which statement best describes defense in depth beyond a single control?

• A. It relies on a single, strongest control
• B. It uses layered security controls across people, processes, and technology
• C. It focuses only on network firewalls
• D. It relies exclusively on user training

Answer: (D)

Defense in depth means using multiple layers of protection so a breach would have to defeat several independent controls. This approach spreads safeguards across people, processes, and technology, creating redundancy and reducing the risk that any single weakness leads to compromise. Think of combining strong authentication, access control, encryption, regular patching, network segmentation, monitoring, incident response, and security training. If one line of defense is bypassed, others still stand a chance to stop the attacker or limit damage, and ongoing activities like monitoring and rapid response help detect and recover from incidents quickly. Relying on a single strongest control leaves a hole if that control fails or is bypassed. Focusing only on network firewalls misses how users, data, applications, and devices can be attacked, and relying exclusively on user training ignores that people can make mistakes and that technical measures and processes are needed to prevent breaches. So the description that best captures defense in depth is using layered security controls across people, processes, and technology.