mediumMultiple Choice
ISC2 CC Practice Question: Designing a secure network architecture for its…
A company is designing a secure network architecture for its new headquarters. The security team proposes implementing multiple layers of security controls, including firewalls, intrusion detection systems, and access control lists. Which security principle is being primarily applied?
⚠ Common exam trap
The trap is confusing defense in depth with least privilege or separation of duties — candidates see 'multiple controls' and may pick least privilege, but the defining feature here is layering independent controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth
Defense in depth is the principle of layering multiple independent security controls so that if one fails, others still protect the asset. Firewalls, IDS, and ACLs are complementary layers at different points in the network, which is the textbook definition of defense in depth. The other options describe different principles that are not about layering controls.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Defense in depth
Why this is correct
Layering firewalls, intrusion detection systems and access control lists creates overlapping, independent controls so that no single failure exposes the network. This deliberate stacking of complementary safeguards across the architecture is precisely the defence-in-depth principle the proposal applies.
- ✗
Separation of duties
Why it's wrong here
Separation of duties splits a single critical task across different people to prevent fraud; layering firewalls, IDS and ACLs is defence in depth. It is tempting because both are administrative controls, but separation of duties addresses who performs actions, not how many independent barriers protect a host.
- ✗
Least privilege
Why it's wrong here
Least privilege grants users only the permissions their role requires; layering firewalls, IDS and ACLs is defence in depth. It is tempting because both reduce attack surface, but least privilege constrains account rights, whereas the scenario describes multiple independent controls protecting the same asset.
- ✗
Need-to-know
Why it's wrong here
Need-to-know restricts an individual's access to information required for their specific role; stacking firewalls, IDS and ACLs is defence in depth. It is tempting because both limit exposure, but need-to-know governs data authorisation decisions, not the deployment of multiple overlapping network enforcement points.
Visual reference
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
IDS
An IDS is a security system that monitors network or system traffic for suspicious activity and alerts administrators to potential threats, but does not actively block them.
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.