Defense in depth is best described as?

• A. A single strong control.
• B. A multi-layered protection strategy where multiple independent controls provide redundant safeguards.
• C. Relying on encryption at rest alone.
• D. Focusing purely on user training.

Answer: (D)

Defense in depth means building security as a cascade of independent controls across people, processes, and technology so that if one layer fails, others still stand between the threat and the asset. The idea is to implement a multi-layered protection strategy where several controls operate in concert to provide redundant safeguards. This creates overlapping defenses that reduce risk from a wide range of attack methods. For example, combining strong authentication, access controls, network segmentation, endpoint protection, encryption, continuous monitoring, and a solid incident response plan covers different angles of defense and helps prevent a breach even if one control is bypassed. Relying on encryption at rest alone leaves gaps—data can be exposed during use or transit, or keys could be compromised—so it doesn’t provide the full protective coverage. Similarly, focusing only on user training misses the technical, procedural, and detection layers that protect systems in real-world scenarios. A single, strong control can still fail or be bypassed, but multiple independent controls offer redundancy and broader protection.