Defense in Depth and Zero Trust
Key Takeaways
Subdomain 4.2 names Defense in Depth and Zero Trust (ZT) as network security architecture concepts.
Defense in depth uses several layers of controls so that one failed layer is not the only protection.
Zero trust does not treat a network location as proof of trust; each access is checked.
Source: ISC2 CC Exam Outline effective September 1, 2026, subdomain 4.2, checked 2026-10-22.
Defense in Depth
Subdomain 4.2 names Defense in Depth as a network security architecture concept. Several layers of controls protect the same asset, so that one failed layer does not leave it unprotected. The outline does not name the layers; the concept is the point.
Source: ISC2 CC Exam Outline effective September 1, 2026 (v01/2026), subdomain 4.2, https://www.isc2.org/certifications/cc/cc-certification-exam-outline, checked 2026-10-22.
Zero Trust
Subdomain 4.2 also names Zero Trust (ZT). The principle is that a location on the network is not trust in itself; each access request is checked. The CC outline page says candidates must understand how defense in depth and zero trust support the goal of keeping AI training data in a secure network environment.
What the Outline Lists for This Section
The outline names these items. Be able to explain each one in plain language and apply it to a short scenario:
- 4.2: Network segmentation (e.g., firewall zones, VLAN, micro-segmentation)
- 4.2: Defense in Depth
- 4.2: Zero Trust (ZT)
Common Traps
A common trap is treating a single strong control as defense in depth. The concept depends on several layers, and Zero Trust depends on checking each access rather than trusting a network location.
Which principle does Zero Trust apply to a request from inside the network?
The request is still checked, because location alone is not trust
The request is trusted because it comes from inside the corporate network and was not flagged earlier
The request skips authentication because the internal network has already verified the user's identity
The request is only logged after it succeeds, so that the security team can review it at the end of the day
Which statements describe defense in depth? Select all that apply.
Select all that apply
It uses several layers of controls
One strong control is enough if it is strong
A failed layer should not leave the asset unprotected
It is a single product purchase
Sections you finish are checked off in the contents.