What is the primary purpose of defense in depth and segmentation in DoD networks?

• A. To centralize all security controls in one location
• B. To maximize throughput
• C. To reduce the cost of security by eliminating layers
• D. To provide multiple layers of defense and limit lateral movement

Answer: (D)

Defense in depth and segmentation implement multiple layers of protection and limit lateral movement within the network. By layering security controls from perimeter to host and data, and by dividing the network into zones with strict access between them, a breach in one area doesn’t automatically compromise everything. If an attacker gets past one layer, others still stand guard, and segmentation confines any intrusion to a smaller portion of the network, making it harder to reach sensitive assets. This approach also supports better detection, containment, and controlled access across zones, which is essential for DoD networks. The other options describe centralizing controls, prioritizing throughput, or removing layers to cut costs, none of which align with the goal of hardening the network through layered protection and restricted movement.