CyberCertPrepNetwork FundamentalsNetwork Security BasicsEASYFree question
What is 'defense in depth' in network security, and which combination of controls best illustrates the concept?
- A.Using only a single enterprise-grade NGFW to handle all threats
- B.Encrypting all data at rest and in transit as the single control, given that certificate pinning lets a server accept any client certificate signed within the last year
- C.Layering perimeter firewall, network IPS, host-based firewall, endpoint AV, and network segmentation so that bypassing one layer does not compromise the whole system
- D.Running all servers in the DMZ so they are isolated from internal users, because MAC filtering defeats spoofing because burned-in addresses cannot be altered in software
Why C is correct
Defense in depth means using multiple independent security layers (perimeter controls, network controls, host controls, data controls) so that a single failure does not lead to a total breach. NIST SP 800-53 and CompTIA Network+ both describe this concept. A single NGFW is a single point of failure. Encryption alone does not address network access control. DMZ placement is one layer, not a layered approach.
Know someone studying for Network Fundamentals? Send them this one.