An important principle of defense in depth is that achieving information security requires a balanced focus on which PRIMARY elements?

Question

Options

• ADevelopment, testing, and deployment
• BPrevention, detection, and remediation
• CPeople, technology, and operations
• DCertification, accreditation, and monitoring

• B
  5% (1)
• C
  90% (19)
• D
  5% (1)

Explanation

Defense in depth recognizes that security cannot be achieved through technology alone - it requires People (trained, aware humans), Technology (tools, controls, systems), and Operations (processes, policies, procedures) working together in balance. If any one element is neglected, the overall security posture weakens regardless of how strong the others are.

Why the distractors are wrong:

• A (Development, testing, deployment) describes a software delivery lifecycle, not a security framework - these are engineering phases, not security pillars.
• B (Prevention, detection, remediation) is a valid incident response model but describes stages of response, not the foundational elements that must be balanced across an organization.
• D (Certification, accreditation, monitoring) relates to formal compliance and authorization processes (common in government/FISMA contexts), not the core structural balance defense in depth demands.

Memory tip: Think "PTO" - People, Technology, Operations - like a job posting: you need the right people, with the right tools, following the right processes. A great firewall (technology) means nothing if staff ignore alerts (people) or there's no incident response plan (operations).

No community discussion yet for this question.