A security analyst discovers that an attacker breached the perimeter firewall but was stopped before reaching the database. The CISO notes that segmentation and intrusion detection worked exactly as designed: no single control failed, yet the breach was contained. That outcome reflects defense-in-depth: the assumption that any single control will eventually fail, so multiple overlapping controls must exist.
AICPA Representative Tasks (verbatim). 1. Remembering & Understanding, Identify ways to protect networks and devices used to access the network remotely (e.g., isolation and segmentation, virtual private network (VPN), wireless network security, endpoint security, system hardening, intrusion prevention and detection systems). 2. Remembering & Understanding, Recall the definition and purpose of vulnerability management. 3. Remembering & Understanding, Explain the concepts of layered security and defense-in-depth. 4. Remembering & Understanding, Define the concepts of least-privilege, zero-trust, and the need-to-know principle. 5.
HIGH-FREQUENCY: Defense-in-depth is the foundational security architecture principle tested on the exam. The concept assumes no single control is perfect; attackers will eventually bypass any individual safeguard.
Common mistakes
- Confusing IDS and IPS. IDS detects and alerts; IPS detects and blocks. The exam will describe a scenario where traffic is blocked automatically. That is IPS (preventive). If the security team receives an alert and manually responds, that is IDS (detective).
- Treating MFA as foolproof. MFA dramatically reduces risk but does not eliminate it. Attackers use MFA fatigue (repeated prompts until the user approves), session hijacking, and phishing for MFA codes. The exam may present a breach despite MFA and ask what additional control was missing.
- Confusing authentication and authorization. Authentication proves identity; authorization determines access. A user who logs in successfully (authentication) may still be denied access to a file (authorization). The exam tests this distinction frequently.
Bottom line
- Defense-in-depth layers independent controls (network segmentation, endpoint hardening, IDS/IPS, access controls) so failure of one creates no single point of failure
- Least privilege grants minimum necessary access; need-to-know restricts data by job function; zero trust verifies every request regardless of network location
- Preventive controls stop threats before impact (firewalls, MFA); detective controls identify threats in progress (IDS, log analysis); corrective controls restore operations (patches, quarantine)
- Authentication proves identity using knowledge, possession, and inherence factors; MFA requires two or more factors from different categories
Exam shortcut
IDS alerts, IPS blocks. If the scenario describes automatic blocking of malicious traffic, the control is an IPS (preventive). If the scenario describes an alert requiring human action, the control is an IDS (detective). Factor counting for MFA. Count categories, not methods. Two passwords are single-factor. Password plus fingerprint is two-factor (knowledge plus inherence).
The full lesson (about 3,175 words, 21 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- II.B2
Browse all free CPA ISC lessons or jump into free CPA ISC practice questions.