Which description is a defense-in-depth principal strategy?

While a form of control, isolating employees is not a primary 'defense-in-depth' technical network or system strategy, but rather an administrative or physical control measure.

Implementing VLANs (Virtual Local Area Networks) to segment network traffic is a classic defense-in-depth strategy. It creates logical boundaries within a physical network, preventing unauthorized access between different segments and limiting the blast radius of a successful breach, thereby adding a layer of protection.

Developing an approval flow for new hires is an administrative security control related to onboarding and access management, not a technical defense-in-depth strategy.

Designing Active Directory groups is an administrative task for managing permissions and roles, which supports security but is not a standalone defense-in-depth strategy itself.