Which of the following is NOT a component of Defense in Depth?

• A. Physical security measures
• B. Data encryption methods
• C. Single-layer security protocols
• D. User awareness training

Answer: (C)

Defense in Depth is a security strategy that employs multiple layers of security controls throughout an information system. The goal is to provide redundancy in the event that one layer fails.

Physical security measures are essential components, as they protect the physical assets of the organization from unauthorized access and assist in safeguarding data. Data encryption methods are also a critical part of this strategy, as they protect data at rest and in transit, reducing risks associated with data breaches. User awareness training is important as well, ensuring that employees understand security policies and recognize potential threats, which enhances overall security posture.

In contrast, single-layer security protocols do not align with the principles of Defense in Depth. Such an approach relies on one measure of security, which can create a vulnerability if that single defense is breached. Implementing multiple layers is essential to achieving a robust security framework, thereby making single-layer security protocols insufficient for comprehensive protection against threats.