In attempting to provide a layered defense, the security practitioner should convince senior management to include security controls of which type? Response:

Technological controls alone, while crucial, do not cover physical access or human behavior aspects of security.

Physical controls prevent unauthorized access to facilities and hardware but do not protect against cyber threats or user errors.

Administrative controls establish policies and procedures but require technological and physical enforcement to be fully effective.

A layered defense, also known as defense in depth, mandates the implementation of security controls from all categories: Technological (e.g., firewalls, encryption), Physical (e.g., locks, fences), and Administrative (e.g., policies, training) to provide multiple barriers against threats. Relying on only one type of control leaves significant gaps in an organization's security posture.