Defense-in-depth layer protection solutions
A security administrator is implementing defense-in-depth. Which set of solutions applies protections across each layer of the defense-in-depth approach?
Community Insight
The core trap is selecting options that cluster controls within a single domain (like only IAM or only network tools) rather than providing coverage across distinct architectural layers.
This question evaluates the understanding of defense-in-depth by identifying a solution set that spans multiple security layers including identity, data, network, and endpoints.
Candidates often choose Option A or B because they focus heavily on perimeter and endpoint technologies, overlooking the critical identity and data layers required for true defense-in-depth.
Community Discussion (1 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
Option C is the correct answer because it provides a comprehensive set of controls that map to distinct layers of the defense-in-depth model. Identity and Access Management (IAM) secures the user/identity layer, encryption protects the data layer at rest and in transit, IPS/IDS monitors and filters traffic at the network layer, and Endpoint Detection and Response (EDR) secures individual devices at the endpoint layer. As noted by community member Roattana, "A true defense-in-depth strategy requires implementing security controls across completely different architectural layers... IAM protects the Identity/User layer. Encryption protects the Data layer. IPS/IDS protects the Network layer. EDR protects the Endpoint/Host layer." This variety ensures that if one layer fails, others remain intact.Why the Other Options Are Wrong
Option A mixes network controls (IPS/IDS, firewall) with a user-behavior control (strong passwords), but lacks specific data-layer protection like encryption. Option B focuses almost entirely on technical malware and network defenses (Antivirus, Firewall, EDR, IPS/IDS), missing the identity and data governance aspects. Option D lists only Identity and Access Management controls (Passwords, MFA, IAM), which represents a single layer of defense rather than a multi-layered approach.Community Comment Notes
The community consensus strongly supports Option C. One commenter explicitly broke down the mapping: "IAM protects the Identity/User layer. Encryption protects the Data layer. IPS/IDS protects the Network layer. EDR protects the Endpoint/Host layer," highlighting why this mix is superior to the other choices which are more homogenous in their layer coverage.Exam Strategy
When answering defense-in-depth questions, look for the option that includes controls from different categories (e.g., Physical, Technical, Administrative) or different layers (Network, Host, Application, Data). Avoid options that list multiple variations of the same type of control.
Frequently Asked Questions
Why isn't a firewall enough for defense-in-depth?
A firewall only protects the network perimeter. Defense-in-depth requires additional layers such as endpoint security, data encryption, and identity management to protect against threats that bypass the perimeter.
Is encryption considered a layer in defense-in-depth?
Yes, encryption protects the 'Data' layer. Even if an attacker breaches the network or endpoint, encrypted data remains unreadable without the key, adding a critical layer of defense.