A study group debates why defence in depth places administrative, technical, and physical controls together in layers. Which statement best captures the rationale for combining the three categories?
- ACombining categories lets an organisation discard the weakest layer once a stronger layer is proven effective.
- BIf one control fails or is bypassed, controls from other categories can still detect, deter, or stop the threat. Correct
- CUsing all three categories guarantees that no attacker can ever breach the protected environment.
- DLayering the categories chiefly lowers cost by letting one physical control replace all technical controls.
Why A is wrong: This misreads the concept: defence in depth retains overlapping layers deliberately rather than removing any once another appears strong.
Why B is correct: Defence in depth assumes any single control may fail, so overlapping layers across categories provide redundancy that keeps protection intact when one layer is defeated.
Why C is wrong: This is tempting but overstated: layering reduces risk and buys time, yet it offers no absolute guarantee against every breach.
Why D is wrong: Cost may improve indirectly, but the categories address different weaknesses and cannot substitute for one another, so this misstates the purpose.