A board member asks why the company funds endpoint protection, email security, DNS-layer filtering, MFA, and segmentation instead of relying on one top-tier perimeter firewall. Which answer reflects the principle of defense in depth?
Select an answer to reveal the explanation.
Short Explanation
Think of a bank: a guard, cameras, a locked vault, and a time lock. If one fails, the others still protect your money. That's defense in depth — layers that overlap, so no single miss becomes a breach.
Full Explanation
Defense in depth places multiple independent layers of protection between threats and assets so that the failure, misconfiguration, or bypass of any one layer does not lead directly to compromise. Each control addresses different attack paths and stages: email security reduces phishing delivery, DNS-layer filtering blocks connections to malicious destinations after a click, MFA limits the value of stolen passwords, endpoint protection detects and stops malware on hosts, and segmentation contains lateral movement. A perimeter firewall, however strong, cannot see encrypted phishing content in a mailbox, cannot stop a user from entering credentials on a fake site, and cannot protect laptops outside the office. The claim that a firewall alone stops every attack is false, and controls justified only by audit would not be part of a coherent design. Cost is not the principle; layered security often costs more than a single product, and it is justified by risk reduction. The layers do not replace firewall features or remove the need for a perimeter; they complement it. Exam caveat: Cisco SAFE applies the same idea by mapping capabilities to places in the network and secure domains. Operational check: for a critical asset, list each attack path and confirm at least two independent controls would have to fail before compromise.