A penetration test report recommends implementing a 'defense-in-depth' strategy as a remediation for multiple findings. A junior analyst asks what this means. Which description is most accurate?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — b is correct because defense-in-depth (also called layered security or the Castle Approach) involves implementing multiple overlapping security controls across network, host, application, and data layers so that an attacker must defeat multiple independent controls to successfully attack an asset. A is wrong because defense-in-depth is the opposite of relying on a single strong control; it explicitly assumes any individual control can fail and prepares compensating layers.
Full explanation below image
Full Explanation
B is correct because defense-in-depth (also called layered security or the Castle Approach) involves implementing multiple overlapping security controls across network, host, application, and data layers so that an attacker must defeat multiple independent controls to successfully attack an asset. A is wrong because defense-in-depth is the opposite of relying on a single strong control; it explicitly assumes any individual control can fail and prepares compensating layers. C is wrong because accepting risk on less important assets may be appropriate but is risk management, not defense-in-depth. D is wrong because AI/ML detection is a single tool technology; defense-in-depth is an architectural principle spanning technology, process, and people.