A municipal security design stacks a WAF, network security groups, and IAM policies rather than depending on a single control. What principle does this architecture illustrate?
Select an answer to reveal the explanation.
Short Explanation
One lock on the front door is nice; locks, cameras, and a badge system are better. Stacking WAF, NSGs, and IAM means each layer catches what another might miss. That layered approach is defense in depth—not betting the city on a single control.
Full Explanation
Defense in depth combines complementary controls—such as WAF for Layer 7 web threats, NSGs for instance traffic filtering, and IAM for identity authorization—so failure of one control does not fully expose the environment. A WAF does not replace IAM, storage versioning does not replace network filters, and physical door locks alone do not secure multi-cloud APIs. Cloud+ security control objectives emphasize selecting and stacking the right controls for each threat.