What is defense in depth, and how does it relate to zero trust?
What they are really testing: Whether you think in layers and have moved past the perimeter model. They want to hear "assume breach" and least privilege, not "we have a firewall".
A real interview question
What is defense in depth, and how does it relate to zero trust?
What most people say
drag me
“Defense in depth means having multiple firewalls so attackers cannot get through.”
It reduces layering to "more firewalls", all at the network layer. Real defense in depth spans network, identity, app, and data, and the answer misses zero trust and assume-breach entirely.
The follow-ups they ask next
What does "assume breach" change about how you design a system?
You stop relying on a trusted interior: segment aggressively, least-privilege everything, authenticate service-to-service (mTLS), and log/monitor for lateral movement, so a single compromise stays contained.
Give an example of two different layers protecting the same asset.
A database: network rules limit who can reach it, IAM/authZ limits who can query it, and at-rest encryption protects the stored bytes. Defeating one does not defeat the others.
What the interviewer is listening for
- Layers span network/identity/app/data
- Knows zero trust drops perimeter trust
- Says verify explicitly / least privilege / assume breach
What sinks the answer
- "More firewalls"
- All layers at the network only
- Still trusts the internal network
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“Defense in depth is [independent layers, network, identity, app, data, so one failure is not fatal]. Zero trust is [the modern version: never trust by network location, authenticate and authorize every request]. Principles: [verify explicitly, least privilege, assume breach], so even [internal calls get mTLS and least-privilege policies].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the CIA triad, and why is it a useful way to think about security?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free