CCP Defense-in-Depth Architecture 3 — Questions and Answers
Question 1: Which defense-in-depth strategy assumes that internal users and systems may be compromised and enforces strict verification for every access request?
- Perimeter-only defense
- Zero Trust Architecture (Correct answer)
- Implicit trust model
- Defense by deterrence
Correct answer: Zero Trust Architecture
Zero Trust Architecture applies 'never trust, always verify' principles, treating internal traffic with the same scrutiny as external traffic.
Question 2: An organization uses data classification, DLP tools, and encryption to protect sensitive files. Which defense-in-depth layer is being addressed?
- Network layer
- Physical layer
- Data layer (Correct answer)
- Application layer
Correct answer: Data layer
Data layer controls protect information itself through classification, encryption, and loss prevention regardless of the transport path.
Question 3: A security team deploys honeypots throughout the internal network. What defense-in-depth benefit do honeypots primarily provide?
- Prevent attackers from entering the network
- Detect lateral movement and gather attacker intelligence (Correct answer)
- Replace network monitoring tools
- Encrypt communications between internal hosts
Correct answer: Detect lateral movement and gather attacker intelligence
Honeypots lure attackers into fake systems, exposing lateral movement and providing intelligence about attacker tactics without risking real assets.
Question 4: Which principle ensures that if one security control is defeated, another independent control still protects the asset?
- Redundancy of controls (Correct answer)
- Single-factor authentication
- Perimeter focus
- Security through complexity
Correct answer: Redundancy of controls
Redundancy of controls is the core defense-in-depth principle where multiple independent safeguards protect assets even when one fails.
Question 5: In a layered security architecture, what is the purpose of a bastion host?
- Serve as a hardened gateway for administrative access to internal networks (Correct answer)
- Provide cloud backup for critical servers
- Run antivirus scans across all endpoints
- Monitor user behavior analytics
Correct answer: Serve as a hardened gateway for administrative access to internal networks
A bastion host is a specially hardened server that provides a secure and monitored entry point for administrative access, reducing the internal attack surface.
Question 6: Which control type in defense-in-depth is designed to minimize the impact of a security incident after it has occurred?
- Preventive control
- Detective control
- Corrective control (Correct answer)
- Deterrent control
Correct answer: Corrective control
Corrective controls, such as patch management and incident response procedures, reduce the damage after a security event has taken place.
Question 7: A penetration tester successfully bypasses a perimeter firewall but is blocked by host-based firewalls on each server. Which defense-in-depth outcome does this illustrate?
- The perimeter firewall was unnecessary
- Layered controls contained the breach to the perimeter
- Host-based firewalls are superior to network firewalls
- Redundant layers prevented the attack from reaching its target (Correct answer)
Correct answer: Redundant layers prevented the attack from reaching its target
This scenario demonstrates defense-in-depth working as intended — the failure of one layer did not result in full compromise because additional layers were in place.
CCP Defense-in-Depth Architecture 3
Which defense-in-depth strategy assumes that internal users and systems may be compromised and enforces strict verification for every access request?