With regard to defense-in-depth, which of the following statements about network design principles is correct?

While Internet-facing systems require hardening, prohibiting all Internet access contradicts the operational requirements of most architectures and does not describe a complete defense-in-depth network design principle.

VLANs are a useful segmentation tool, but relying solely on VLAN implementations is insufficient for defense-in-depth because VLANs are susceptible to hopping attacks and must be combined with additional layered controls.

Providing an administrative structure is an organizational governance control, not a technical network design principle, and does not address the layered security boundaries required by defense-in-depth.

A foundational principle of defense-in-depth is network segmentation - establishing security boundaries such as firewalls, DMZs, or controlled access zones between resource groups so that a compromise in one segment does not automatically grant access to others. This layered approach forces an attacker to defeat multiple independent controls to reach sensitive assets, significantly reducing overall risk exposure.