What is defence in depth, and how would you explain it with a real example?

What the interviewer wants to hear

• Multiple independent layers of security controls
• One control failing should not lead to a full breach
• Mix of preventive, detective and recovery controls
• Concrete example such as phishing stopped by later layers

Model answer

Defence in depth means protecting systems with several independent layers, so that if one control fails, others still stop or limit the attacker. No single tool is perfect, so we avoid a single point of failure. A phishing example shows it well. The email gateway may miss a malicious link. If the user clicks and enters their password, MFA stops the attacker from logging in. If malware runs, EDR can detect and block it. Network segmentation limits how far it can spread, and logging in the SIEM helps the SOC detect what happened. Finally, offline backups let us recover if ransomware still gets through. Good layering mixes preventive, detective and recovery controls, and covers people, process and technology, not only tools.

More easy Cybersecurity Analyst questions

• Explain the CIA triad and give a real example of an attack on each part.
• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?