Defense-in-depth layer protection solutions
Short answer
C Identity and access management (IAM), encryption, IPS/IDS, and endpoint detection and response (EDR) solutions provide layered protection across identity, data, network, and endpoint domains.
Question
Which set of solutions applies protections across each layer of the defense-in-depth approach?
Key Takeaways
The core trap is selecting options that cluster controls within a single domain (like only IAM or only network tools) rather than providing coverage across distinct architectural layers.
This question evaluates the understanding of defense-in-depth by identifying a solution set that spans multiple security layers including identity, data, network, and endpoints.
Common mistake: Candidates often choose Option A or B because they focus heavily on perimeter and endpoint technologies, overlooking the critical identity and data layers required for true defense-in-depth.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because it provides a comprehensive set of controls that map to distinct layers of the defense-in-depth model. Identity and Access Management (IAM) secures the user/identity layer, encryption protects the data layer at rest and in transit, IPS/IDS monitors and filters traffic at the network layer, and Endpoint Detection and Response (EDR) secures individual devices at the endpoint layer. As noted by community member Roattana, "A true defense-in-depth strategy requires implementing security controls across completely different architectural layers... IAM protects the Identity/User layer. Encryption protects the Data layer. IPS/IDS protects the Network layer. EDR protects the Endpoint/Host layer." This variety ensures that if one layer fails, others remain intact.
Why the Other Options Are Wrong
Option A mixes network controls (IPS/IDS, firewall) with a user-behavior control (strong passwords), but lacks specific data-layer protection like encryption. Option B focuses almost entirely on technical malware and network defenses (Antivirus, Firewall, EDR, IPS/IDS), missing the identity and data governance aspects. Option D lists only Identity and Access Management controls (Passwords, MFA, IAM), which represents a single layer of defense rather than a multi-layered approach.
Community Comment Notes
The community consensus strongly supports Option C. One commenter explicitly broke down the mapping: "IAM protects the Identity/User layer. Encryption protects the Data layer. IPS/IDS protects the Network layer. EDR protects the Endpoint/Host layer," highlighting why this mix is superior to the other choices which are more homogenous in their layer coverage.
Exam Strategy
When answering defense-in-depth questions, look for the option that includes controls from different categories (e.g., Physical, Technical, Administrative) or different layers (Network, Host, Application, Data). Avoid options that list multiple variations of the same type of control.
Frequently Asked Questions
Why isn't a firewall enough for defense-in-depth?
Is encryption considered a layer in defense-in-depth?
Discussion 1 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 1
-
Roattana 👍 1 Answered CA true defense-in-depth strategy requires implementing security controls across completely different architectural layers (such as network, data, endpoint, and identity). • IAM protects the Identity/User layer. • Encryption protects the Data layer. • IPS/IDS protects the Network layer. • EDR protects the Endpoint/Host layer.
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.