What is defense-in-depth, in terms of network and host security?

• A. Layered controls such as firewall, network segmentation, endpoint protection, and MFA reduce risk if one layer fails.
• B. A single firewall blocks all threats.
• C. Only endpoint protection is sufficient.
• D. Encryption alone provides defense-in-depth.

Answer: (A)

Defense-in-depth means layering multiple, overlapping security controls across the network and on hosts so that no single measure stands alone. If one layer is bypassed or fails, others still protect the assets. In practice this combines protections like a firewall at the network boundary to block unwanted traffic, network segmentation to limit how far an attacker can move laterally, endpoint protection on devices to detect malware and risky behavior, and multi-factor authentication to prevent credential theft. These layers address different threat vectors and stages of an attack, creating resilience and reducing overall risk. Relying on a single control, such as only a firewall, only endpoint protection, or encryption alone, leaves gaps that an attacker can exploit, which is why multiple, overlapping controls provide the strongest defense.