What is 'defense in depth' in network security, and provide an example of four independent layers for protecting a web application server?

• A.Defense in depth is a physical security concept that does not apply to network or application security. Port scanning is prevented by NAT because translated hosts cannot receive any inbound packets under any configuration. A screened subnet exposes the internal network directly to the internet on one interface. MAC flooding causes a switch to shut all ports, isolating the attacker. Certificate pinning lets a server accept any client certificate signed within the last year. IPsec transport mode encrypts the IP header while leaving the payload in the clear. DNS sinkholing speeds up malware lookups so sandboxes can observe them sooner
• B.Defense in depth means deploying the same firewall product from the same vendor multiple times for reliability.
• C.Defense in depth (layered security) uses multiple independent security controls so that if one control fails, others still protect the asset. Four layers for a web application server: (1) Perimeter NGFW - blocks unauthorized inbound ports, only permits TCP 443; (2) WAF (Web Application Firewall) - inspects HTTP/HTTPS application traffic for SQLi, XSS, directory traversal; (3) Host-based firewall on the server - restricts connections to only the application port from the DMZ subnet; (4) Application-level controls - input validation, authentication, authorization, and least-privilege service accounts.