A company places every security control at the data-center internet edge: a next-generation firewall, IPS and web filtering. Half the staff now work remotely and reach SaaS applications directly from home without a VPN. What is the main defense-in-depth gap in this design?
Select an answer to reveal the explanation.
Short Explanation
A great front-door lock doesn't help if half the household now comes and goes through the back gate. Your edge stack is fine; the problem is that remote users and cloud apps never pass it. Watch for answers that tinker with the edge instead of covering the traffic that bypasses it.
Full Explanation
Layered security only protects traffic that actually traverses the layers. A design that concentrates the firewall, IPS and web filtering at one internet edge assumes users and applications sit behind that edge. Once users work remotely and connect straight to SaaS, their traffic follows a path that touches none of those controls, so the remote population has effectively zero network-layer inspection. Closing the gap means extending controls to where users and workloads are: endpoint protection, cloud-delivered security such as a secure web gateway and DNS security, and identity-based access. Removing the firewall or the IPS because they overlap reverses the principle; overlapping, independent layers are the goal of defense in depth. Claiming web filtering belongs only on endpoints is wrong; filtering can be delivered at the edge, in the cloud or on the host, and an edge deployment does not break the policy. Switching the edge firewall to transparent mode changes how it is inserted into the network, not which traffic reaches it, so it still never sees home-to-SaaS sessions. Exam caveat: when a stem describes users or workloads outside the perimeter, look for the answer that moves controls to them. Operational check: map each user population's traffic path to SaaS and confirm at least two independent inspection layers on each path.