An organization is implementing a defense-in-depth strategy. Which THREE of the following are considered security controls that can be used? (Choose THREE.)
Trap 1: Single sign-on
Single sign-on (SSO) is an authentication convenience that reduces password fatigue, but it is not a security control in the context of defense-in-depth because it creates a single point of failure and does not add a layer of protection.
Trap 2: Acceptable use policy
AUP is an administrative policy, not a technical security control.
- A
Firewall
A firewall is a network security control that filters traffic.
- B
Antivirus software
Antivirus is a host-based control that detects malware.
- C
Single sign-on
Why wrong: Single sign-on (SSO) is an authentication convenience that reduces password fatigue, but it is not a security control in the context of defense-in-depth because it creates a single point of failure and does not add a layer of protection.
- D
Encryption
Encryption protects data confidentiality.
- E
Acceptable use policy
Why wrong: AUP is an administrative policy, not a technical security control.