Defense in depth

Defense in depth places multiple layers of control between a threat and an asset so that no single failure is fatal. The layers span all three control families: physical (fences, locks, guards), technical (firewalls, encryption, endpoint protection), and administrative (policies, vetting, training). An attacker who slips past the firewall still meets a hardened host, an account constrained by least privilege, and monitoring that notices the lateral movement. The design assumption is blunt: every individual control can and eventually will fail.

The nuance the exam probes is diversity and independence. Two firewalls from the same vendor running the same ruleset are one layer twice, not depth; layers only count when a different mechanism, operated by a different process, would have to fail in the same way at the same time. Depth is also not an excuse for weak components: it complements strong controls rather than replacing them, and it pairs naturally with modern architectures instead of competing with them.

Exam relevance: if a scenario shows an organisation relying on one control whose failure exposes everything, the answer is defense in depth, or the lack of it. If a question asks which principle layers physical, technical, and administrative controls, that is defense in depth by definition. Contrast it with zero trust: depth stacks barriers but can still trust the interior; zero trust removes implicit trust from network location entirely.