(ISC)2 Certified in Cybersecurity Practice Exam

Which approach to cybersecurity includes the concept of using layered defenses?

1. Confidentiality

2. Access Control

3. Defense in Depth

4. Risk Management

The correct answer is: Defense in Depth

Using layered defenses in cybersecurity is best encapsulated by the concept of Defense in Depth. This strategy involves implementing multiple layers of security controls to protect information and resources. The idea is that if one layer of security fails, there are additional layers that can provide protection, thus reducing the likelihood of a successful attack. In Defense in Depth, layers can include physical security measures, firewalls, intrusion detection systems, antivirus software, access controls, and employee training. This multi-faceted approach addresses various attack vectors, providing redundancy and making it more challenging for attackers to breach the system. Other options, while important components of a comprehensive security strategy, do not specifically highlight the layered approach. Confidentiality focuses on ensuring that data is kept secret from unauthorized users. Access Control pertains to who can access certain resources and their permissions, but it does not imply multiple overlapping defenses. Risk Management involves identifying, assessing, and prioritizing risks but does not inherently describe a layered defensive mechanism. Thus, Defense in Depth is the correct choice as it explicitly outlines a layered approach to safeguarding systems and data from cyber threats.