CCP Defense-in-Depth Architecture 2

Question 1

Which defense-in-depth layer is responsible for controlling access to physical hardware, server rooms, and network equipment?

Accepted Answer

Physical security

Answer

Physical security is the outermost defense-in-depth layer protecting hardware and facilities from unauthorized physical access.

Question 2

A company implements VLAN segmentation, DMZ zones, and internal firewalls. Which defense-in-depth principle does this best represent?

Accepted Answer

Network segmentation and zoning

Answer

Network segmentation and zoning divides the network into isolated areas so a breach in one zone does not immediately compromise others.

Question 3

In a defense-in-depth model, what is the primary purpose of an intrusion detection system (IDS) deployed inside the network perimeter?

Accepted Answer

Detect threats that bypassed perimeter controls

Answer

An IDS deployed internally acts as a secondary control to detect malicious activity that has already passed through perimeter defenses.

Question 4

Which concept ensures that no single compromise of a control or layer results in full system access?

Accepted Answer

Layered security (defense-in-depth)

Answer

Defense-in-depth ensures redundant layers so that no single control failure grants total access to protected resources.

Question 5

A web application firewall (WAF) is best positioned at which defense-in-depth layer?

Accepted Answer

Application layer

Answer

A WAF inspects HTTP/S traffic and filters application-level attacks like SQL injection and XSS, making it an application-layer control.

(CCP) Certified Cybersecurity Professional Practice Test