CCP Defense-in-Depth Architecture 2 — Questions and Answers
Question 1: Which defense-in-depth layer is responsible for controlling access to physical hardware, server rooms, and network equipment?
- Physical security (Correct answer)
- Network perimeter
- Application layer
- Data layer
Correct answer: Physical security
Physical security is the outermost defense-in-depth layer protecting hardware and facilities from unauthorized physical access.
Question 2: A company implements VLAN segmentation, DMZ zones, and internal firewalls. Which defense-in-depth principle does this best represent?
- Defense by obscurity
- Network segmentation and zoning (Correct answer)
- Single point of enforcement
- Least functionality
Correct answer: Network segmentation and zoning
Network segmentation and zoning divides the network into isolated areas so a breach in one zone does not immediately compromise others.
Question 3: In a defense-in-depth model, what is the primary purpose of an intrusion detection system (IDS) deployed inside the network perimeter?
- Block all inbound traffic
- Detect threats that bypassed perimeter controls (Correct answer)
- Replace the need for a firewall
- Encrypt internal communications
Correct answer: Detect threats that bypassed perimeter controls
An IDS deployed internally acts as a secondary control to detect malicious activity that has already passed through perimeter defenses.
Question 4: Which concept ensures that no single compromise of a control or layer results in full system access?
- Single sign-on
- Layered security (defense-in-depth) (Correct answer)
- Unified threat management
- Access transparency
Correct answer: Layered security (defense-in-depth)
Defense-in-depth ensures redundant layers so that no single control failure grants total access to protected resources.
Question 5: A web application firewall (WAF) is best positioned at which defense-in-depth layer?
- Physical layer
- Network perimeter layer
- Application layer (Correct answer)
- Data layer
Correct answer: Application layer
A WAF inspects HTTP/S traffic and filters application-level attacks like SQL injection and XSS, making it an application-layer control.
Question 6: Which term describes the practice of reducing the number of entry points that an attacker can exploit across all defense layers?
- Attack surface reduction (Correct answer)
- Threat modeling
- Zero-day patching
- Security information aggregation
Correct answer: Attack surface reduction
Attack surface reduction minimizes the number of exploitable vectors across all layers, strengthening the overall defense-in-depth posture.
Question 7: What is the role of endpoint detection and response (EDR) in a defense-in-depth architecture?
- Encrypt data at rest on servers
- Monitor and respond to threats on end-user devices (Correct answer)
- Manage firewall rule sets centrally
- Provide VPN tunneling for remote users
Correct answer: Monitor and respond to threats on end-user devices
EDR solutions monitor endpoint activity in real time and provide automated or analyst-driven response to threats at the host layer.
CCP Defense-in-Depth Architecture 2
Which defense-in-depth layer is responsible for controlling access to physical hardware, server rooms, and network equipment?