Which statement best describes defense in depth?

• A. Reduces single points of failure by providing multiple layers of controls.
• B. Increases cost with no benefit.
• C. Focuses on a single perimeter.
• D. Eliminates need for risk assessment.

Answer: (A)

Defense in depth means building multiple layers of defense so that no single control stands alone. The best description is that it reduces single points of failure by providing multiple layers of controls. In practice, this means using a mix of people, processes, and technology—strong access controls with MFA, network segmentation, layered monitoring and detection, regular backups, incident response plans, and security training. If one control is bypassed or compromised, other layers are still protecting assets, making it much harder for an attacker to succeed. This approach emphasizes resilience and redundancy rather than relying on a single perimeter or control. It also involves thoughtful planning and cost-conscious decisions, and it doesn’t eliminate the need for risk assessment; that assessment helps determine where and how to place and strengthen the different layers.