What is 'defense in depth' in network security, and provide an example of four independent layers for protecting a web application server?

• A.Defense in depth (layered security) uses multiple independent security controls so that if one control fails, others still protect the asset. Four layers for a web application server: (1) Perimeter NGFW - blocks unauthorized inbound ports, only permits TCP 443; (2) WAF (Web Application Firewall) - inspects HTTP/HTTPS application traffic for SQLi, XSS, directory traversal; (3) Host-based firewall on the server - restricts connections to only the application port from the DMZ subnet; (4) Application-level controls - input validation, authentication, authorization, and least-privilege service accounts.
• B.Defense in depth means deploying the same firewall product from the same vendor multiple times for reliability.
• C.Defense in depth is a physical security concept that does not apply to network or application security.