At a hospital, the perimeter firewall blocked a network scan, yet ransomware still started from a phishing attachment opened on a ward PC. What does defense in depth say about that outcome?
Select an answer to reveal the explanation.
Short Explanation
A fence that stops a truck does not stop a letter through the mail slot. You still need a later layer for the phishing attachment, because the perimeter firewall only blocked the scan. The trap is blaming the whole model, the user alone, or backup encryption.
Full Explanation
Defense in depth expects different layers to cover different paths. The perimeter firewall blocked a scan, which is a success on a network path, and the ransomware started from a phishing attachment on a ward PC, along a mail and endpoint path the perimeter firewall did not inspect. The lesson is A later layer still has to stop the phish the perimeter firewall did not see. A mail control or the endpoint agent is the layer that had a chance at that attachment. The blocked scan means the layered model failed and should be abandoned entirely misreads a working perimeter control as proof the model is useless. The person on the ward is the only control that matters for this infection ignores the filters and agents that are supposed to sit between a lure and execution. Encryption of the offline backup is the control that failed in this case talks about a recovery copy the scenario never says was involved. The failure described is the attachment that ran. Exam caveat: a layer that did its own job can still leave another path open, which is why the layers have to be different controls. Operational check: trace the attachment from the mail path to the ward PC and confirm whether the mail filter and the endpoint agent inspected it, instead of closing the case on the blocked scan alone.