Which statement accurately defines Layered Defense when protecting assets?

• A. The use of a single, strong control to protect an asset.
• B. The use of multiple controls arranged in series to provide multiple consecutive protections.
• C. An approach that relies solely on encryption to protect data.
• D. An approach that eliminates all controls for efficiency.

Answer: (B)

Layered defense means building multiple protections across different stages so an attacker must overcome several barriers to reach an asset. The strongest fit describes several controls arranged in series to create successive barriers. With this setup, even if one control is bypassed or fails, others still stand in the way, reducing risk and slowing or stopping an attack as it moves through network, host, application, and data layers. This redundancy covers different attack paths and creates defense in depth, rather than relying on a single control. Encryption alone targets confidentiality but doesn’t provide the full multi-layered protection; removing controls eliminates the protective barriers, increasing exposure.