Defense-in-Depth vs Adaptive Security for Unknown Vulnerabilities

312-50v13 By islever Editorial Last updated

Introduction to Ethical Hacking

Short answer

B Establish a Defense-in-Depth strategy by incorporating multiple layers of security measures to increase complexity and decrease attack success likelihood.

Question

Given the complexities of an organization’s network infrastructure, a threat actor has exploited an unidentified vulnerability, leading to a major data breach. As a Certified Ethical Hacker (CEH). you are tasked with enhancing the organization's security stance. To ensure a comprehensive security defense, you recommend a certain security strategy. Which of the following best represents the strategy you would likely suggest and why?
  1. Develop an in-depth Risk Management process, involving identification, assessment, treatment, tracking, and review of risks to control the potential effects on the organization.
  2. Establish a Defense-in-Depth strategy, incorporating multiple layers of security measures to increase the complexity and decrease the likelihood of a successful attack. Correct Answer
  3. Implement an Information Assurance (IA) policy focusing on ensuring the integrity, availability, confidentiality, and authenticity of information systems.
  4. Adopt a Continual/Adaptive Security Strategy involving ongoing prediction, prevention, detection, and response actions to ensure comprehensive computer network defense.

Key Takeaways

The core concept tested is network security architecture, with the common trap being confusion between static layering (DiD) and dynamic adaptation (Adaptive Security).

This question addresses the strategic approach to securing complex networks against unidentified vulnerabilities. It establishes that Defense-in-Depth is the recommended strategy due to its layered protection model.

Common mistake: Candidates often choose Option D (Continual/Adaptive Security) because it sounds comprehensive, but it misses the specific emphasis on structural complexity reduction found in the correct answer.

Expert Analysis

Why the Answer Is Correct

Option B, Defense-in-Depth, is the correct strategy because it explicitly focuses on increasing attack complexity through multiple layers of controls. By deploying redundant security measures across network, host, and application layers, an organization reduces the likelihood of a single point of failure leading to a breach. This aligns perfectly with the scenario of protecting against unknown vulnerabilities where traditional signature-based detection might fail.

Why the Other Options Are Wrong

Option A describes Risk Management, which is a governance process rather than a technical defense strategy for immediate security stance enhancement. Option C outlines Information Assurance goals (CIA triad) but does not specify the architectural method to achieve them. Option D, while valuable, focuses on the lifecycle of prediction and response; however, CEH curriculum traditionally prioritizes Defense-in-Depth as the foundational architectural principle for mitigating unknown threats via complexity.

Community Comment Notes

Community consensus heavily favors Option B, with users noting that DiD provides necessary redundancy. As user Dogeo noted, "A Defense-in-Depth strategy is designed to provide multiple layers of protection." User NikoTomas argued for D, stating that risk assessment should come first, but this overlooks the question's focus on enhancing the active security stance against exploitation.

Exam Strategy

When asked about 'enhancing security stance' against 'unidentified' or 'unknown' threats, look for answers involving 'layers', 'multiple controls', or 'redundancy'. Defense-in-Depth is the standard CEH answer for structural resilience.

Frequently Asked Questions

Why not Adaptive Security for unknown vulnerabilities?

While Adaptive Security is modern, CEH exams prioritize Defense-in-Depth as the fundamental architectural principle for reducing single points of failure against unknown threats.

Is Risk Management a valid security strategy here?

No, Risk Management is a governance framework for identifying and treating risks, not a technical defense strategy like Defense-in-Depth used to harden infrastructure.

More 312-50v13 FAQ →

Community Votes

B
80%
D
20%

80% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. Dogeo 👍 2 Answered B
    A Defense-in-Depth strategy is designed to provide multiple layers of protection across the network and systems. By using a combination of security measures (e.g., firewalls, intrusion detection systems, access controls, encryption, etc.)
  2. NikoTomas 👍 1 Answered D
    Correct is D - At first sight, for me, A looks great - i. e. start from the ground, identify assets, evaluate risks... and as late as risks are known, implement appropriate defensive measures based on it (this is how it should be done in real world). However, A option ends by risk assessment with no defense - and they are asking for "enhancing the organization's security stance" and "ensure a comprehensive security defense". - B - Defense in Depth - ok, it is defense and it is some kind of strategy but it is already incorporated in option D) and much more... that's why D) is better answer. Continuation below...
  3. killwitch 👍 1 Answered B
    Given that a threat actor successfully exploited an unknown vulnerability, the best approach to mitigate future attacks is to implement a Defense-in-Depth (DiD) strategy. This security model incorporates multiple layers of security controls to make it significantly harder for an attacker to breach an organization's infrastructure. DiD reduces single points of failure and ensures that if one layer is compromised, additional layers of security can still protect the system
  4. KiranYS 👍 1 Answered B
    A Defense-in-Depth strategy involves implementing multiple layers of security controls across different areas (network, host, application, and data) to reduce the risk of a successful attack

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Agent-Based vs Network-Based Vulnerability Scanners

S-grade

Network Sniffing Techniques for Penetration Testing

S-grade

File-less Malware Bypassing Application Whitelisting

S-grade

SQL Injection Bypass in Login Forms

S-grade

← Back to 312-50v13 Study Guide