hardMultiple Choice
ISC2 CC Practice Question: A company's security policy requires that all…
A company's security policy requires that all sensitive data be encrypted at rest and in transit. However, a recent breach occurred because an attacker exploited a misconfigured web server that exposed a database directly. Which principle was most lacking in this scenario?
⚠ Common exam trap
Watch out — candidates often confuse defense in depth with least privilege or complete mediation — candidates see 'misconfigured web server' and jump to least privilege, missing that the scenario's core issue is the absence of layered controls beyond encryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth
Defense in depth is the principle of layering multiple security controls so that a single failure does not expose sensitive data. The scenario describes encryption at rest and in transit (two layers) but a misconfigured web server directly exposed the database — a missing network segmentation or access-control layer. The breach succeeded because no additional layer prevented direct database access, which is the essence of a defense-in-depth failure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Least privilege
Why it's wrong here
Least privilege limits account and process permissions, but the breach stemmed from a web server directly exposing a database, a network segmentation failure. Least privilege would be correct if an over-privileged user or service account had accessed data beyond its role.
- ✗
Fail securely
Why it's wrong here
Fail securely governs behaviour after an error, ensuring systems deny access rather than exposing data; here the server was misconfigured and reachable, not failing open. It would be correct if an exception had bypassed authentication or leaked data during failure.
- ✗
Complete mediation
Why it's wrong here
Complete mediation requires every access to every object to be checked against the authorisation policy, which the exposed database bypassed entirely. The breach stem describes an encryption-at-rest and in-transit policy, so the missing control is encryption of stored and transmitted data, not mediation of each request. Complete mediation is tempting because it is a foundational security principle, but it does not address the stated encryption requirement.
- ✓
Defense in depth
Why this is correct
Defense in depth layers multiple independent controls so one failure cannot expose data. A directly reachable database behind a misconfigured web server shows the missing network segmentation and access controls that would have contained the breach.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Encryption at rest
Encryption at rest is the practice of securing stored data by converting it into an unreadable format using cryptographic algorithms, so that even if physical or digital access to the storage medium is obtained, the data remains confidential.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company has implemented a policy where all employees must use a smart card and PIN to access the data center. Which security principle does this practice support?
easy- A.Keep it simple
- ✓ B.Defense in depth
- C.Least privilege
- D.Fail-safe
Why B: The use of both a smart card (something you have) and a PIN (something you know) creates a multi-factor authentication mechanism. This layered approach ensures that even if one factor is compromised, the other still provides protection, which is the core of the defense-in-depth principle. Defense in depth is about implementing multiple, overlapping security controls rather than relying on a single point of defense.
Variation 2. A company's security policy requires that all sensitive data be encrypted both at rest and in transit. This is an example of applying which security principle?
medium- A.Separation of duties
- B.Need to know
- C.Least privilege
- ✓ D.Defense in depth
Why D: Encrypting sensitive data both at rest and in transit applies multiple overlapping controls at different layers of the environment, which is the definition of defense in depth. Rather than relying on a single control, the organization layers cryptographic protections so that compromise of one layer (e.g., a stolen disk) does not automatically expose the data. This is a classic example of layered, redundant security controls.
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.