What is defense in depth?

• A. Single-layer defense
• B. Zero trust
• C. Layered security approach
• D. Data in use encryption

Answer: (C)

Defense in depth means protecting systems by stacking multiple, independent security controls so that if one layer is bypassed, others still stand guard. It relies on a combination of measures across people, processes, and technology to create overlapping protections that address different attack vectors.

Think of it as building several barriers: network boundaries like firewalls and intrusion detection, strong access controls and multi-factor authentication, data protection such as encryption at rest and in transit, ongoing monitoring and incident response, and regular backups with tested recovery. Each layer counters different methods an attacker might use, and together they reduce the chance that a single weakness leads to a compromise. If one control fails, others still help detect, delay, or block the threat.

This is why the layered security approach is the best description. The other options describe narrower ideas: a single-layer defense is the opposite of defense in depth; zero trust is a specific security model about never trusting by default and continuously verifying, which can be part of a defense-in-depth strategy but isn’t the overall concept itself; data in use encryption is a single control, not the overall approach of using multiple layers.