Layered security strategy for enhanced protection?

• A. Layered Security in IAM
• B. Defense-in-Depth
• C. Activity Monitoring
• D. Cost Justification

Answer: (B)

Defense-in-depth is the approach of deploying multiple, overlapping security controls across people, processes, and technology so that compromising one layer doesn’t lead to a breach. In IAM/CIAM this translates to layered protections such as strong authentication (MFA or passwordless), granular authorization with least privilege, secure session management, device posture checks, data encryption, robust logging and monitoring, and rapid incident response. This layered strategy provides defense even if one control is bypassed, which is exactly what “enhanced protection” implies. The idea of layered security in IAM addresses part of this, but the standard term for the overall approach is defense-in-depth. Activity monitoring is a single control within the strategy, and cost justification isn’t about protection itself.