A municipal security design stacks a WAF, network security groups, and IAM policies rather than depending on a single control. What principle does this architecture illustrate?
Select an answer to reveal the explanation.
Short Explanation
One lock on the front door is nice; locks, cameras, and a badge system are better. Stacking WAF, NSGs, and IAM means each layer catches what another might miss. That layered approach is defense in depth—not betting the city on a single control.
Full Explanation
Defense in depth layers complementary controls so failure or bypass of one mechanism does not fully expose the system. Stacking a WAF, network security groups, and IAM policies in a municipal security design illustrates that principle: application-layer filtering, network filtering, and identity authorization each cover different attack paths for civic cloud workloads. No single control is treated as sufficient alone.
Eliminating IAM because a WAF alone authenticates every cloud API caller confuses HTTP edge filtering with management-plane authorization. Removing all network filters once object storage versioning is enabled abandons network defense for a data-recovery feature. Using only physical door locks as sufficient protection for multi-cloud APIs ignores logical cloud threats entirely.
Exam caveat: defense in depth is about diverse control layers (identity, network, application, data, monitoring), not merely buying more of the same firewall. Shared responsibility still applies across layers.
Operational check: map threats to control layers for a citizen service, verify WAF, NSG, and IAM are all enforced (not merely documented), run a tabletop where one layer fails and others still impede attackers, and record residual gaps. Keep the layered design in the city’s cloud security architecture standard.