What is the role of defense-in-depth in security practices?

• A. Rely on a single strong perimeter defense.
• B. Defense-in-depth refers to using multiple databases.
• C. Multiple layers of defense across architecture and controls.
• D. It requires encrypting at rest only.

Answer: (C)

Defense in depth means building multiple overlapping security controls at different layers of the system so compromising one layer doesn't expose everything. By placing protections across the network, applications, data, and operations—and combining technical measures with processes and monitoring—you create redundancy. If an attacker slips past one line of defense, others stand between them and valuable assets, reducing the chance of a full breach and giving you earlier detection and response opportunities. This layered approach also helps address different threat vectors, from network intrusions to application flaws to insider risks, and it supports resilience even when some controls fail or are bypassed.

The other options miss the broader, layered idea. Relying on a single perimeter defense assumes that one wall is enough, which security weaknesses can easily overcome. Thinking defense-in-depth is about using multiple databases misinterprets the concept; the idea isn’t about data stores but about multiple protective layers across the system. Encrypting at rest alone focuses on data protection, but without additional layers like access controls, encryption in transit, monitoring, and incident response, a breach can still occur.