Defense in depth

Defense in depth places multiple layers of control between a threat and an asset so that no single failure is fatal. The layers span all three control families: physical (fences, locks, guards), technical (firewalls, encryption, endpoint protection), and administrative (policies, vetting, training). An attacker who slips past the firewall still meets a hardened host, an account constrained by least privilege, and monitoring that notices the lateral movement. The design assumption is blunt: every individual control can and eventually will fail.

The nuance a well-written scenario is likely to probe is diversity and independence. Two firewalls from the same vendor running the same ruleset are one layer twice, not depth; layers only count when a different mechanism, operated by a different process, would have to fail in the same way at the same time. Depth is also not an excuse for weak components: it complements strong controls rather than replacing them, and it pairs naturally with modern architectures instead of competing with them.

Exam relevance: if a scenario shows an organisation relying on one control whose failure exposes everything, the answer is defense in depth, or the lack of it. If a question asks which principle layers physical, technical, and administrative controls, that is defense in depth by definition. Contrast it with zero trust: depth stacks barriers but can still trust the interior; zero trust removes implicit trust from network location entirely.