Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
ISACA Certified Information Security Manager · Isaca
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
Normally, each platform should have separate security controls! A does not specify what controls these are. To meet the defence in depth requirement, it has to be different types of controls NOT just separateed. For all you know the separate controls are multiple instance of a single control type. But to be defence in depth it has to be different types of controls layered. i.e Firewalls, 2FA, OTP, Encryption in flight and at rest. complex passwords, rate limitng and times outs. so B make a lot more sense
The best description of a defense in depth strategy for an organization adopting a hybrid data infrastructure is D. Strict enforcement of RBAC
While A. is a good practice, it's not the core principle of defense in depth. Defense in depth focuses on layering controls, not just separating them.