Which of the following is an example of defense in depth?

• A. Using a single password policy.
• B. Relying solely on encryption.
• C. Implementing input validation, authentication, authorization, encryption, logging, and network segmentation.
• D. Disabling monitoring to reduce noise.

Answer: (C)

Defense in depth means layering multiple security controls across different parts of the system so that if one control fails, others still stand between the attacker and the assets.

The example covers many distinct controls across different stages of the security stack: input validation prevents malicious data from causing harm, authentication confirms who is trying to access the system, authorization enforces what each authenticated user is allowed to do, encryption protects data even if it’s accessed, logging provides visibility for detection and forensics, and network segmentation limits how far an intruder can move laterally. Together, these layers create multiple barriers that a threat must breach, reducing the chance of a successful attack.

The other options rely on a single protective measure or remove essential protective capabilities, which is not sufficient for strong security. A single password policy doesn’t address other weaknesses or stages of an attack. Relying only on encryption leaves gaps in access control, input handling, and monitoring. Disabling monitoring eliminates the ability to detect and respond to incidents, undermining any security posture.