Strategy of combining multiple security controls to protect resources in identity and access management?

Strategy of combining multiple security controls to protect resources in identity and access management?

• A. Defense-in-Depth
• B. Layered Security in IAM
• C. User Authentication Layer
• D. Activity Monitoring

Answer: (A)

Defense-in-Depth means protecting resources by layering multiple security controls so that no single point of failure fully exposes the system. In identity and access management, this translates to combining authentication, authorization, device posture, contextual/conditional access, least-privilege policies, session management, data protection, and ongoing monitoring. The idea is that even if one control is bypassed, others still stand to block access or detect and respond to misuse, greatly increasing resilience and reducing risk. This approach is broader than any single control. While Layered Security in IAM captures the same spirit, Defense-in-Depth is the established term that describes the strategy of aligning multiple controls across people, processes, and technology. Focusing on just the authentication layer or on activity monitoring describes specific components rather than the overall strategy.

Defense-in-Depth means protecting resources by layering multiple security controls so that no single point of failure fully exposes the system. In identity and access management, this translates to combining authentication, authorization, device posture, contextual/conditional access, least-privilege policies, session management, data protection, and ongoing monitoring. The idea is that even if one control is bypassed, others still stand to block access or detect and respond to misuse, greatly increasing resilience and reducing risk.

This approach is broader than any single control. While Layered Security in IAM captures the same spirit, Defense-in-Depth is the established term that describes the strategy of aligning multiple controls across people, processes, and technology. Focusing on just the authentication layer or on activity monitoring describes specific components rather than the overall strategy.