Defense in depth (also called layered defense) is a security strategy that uses multiple types of security controls so that if one control is bypassed, another can still protect the data or limit the damage, as defined in AP Cybersecurity learning objective 2.1.G.
Defense in depth means you never trust one single security control to do all the work. Instead, you stack layers. If an adversary slips past one, the next layer is still standing. Think of it like a castle: a moat, then walls, then guards, then a locked vault. Breaking through the moat doesn't get you the treasure.
The AP CED also calls this a layered defense (EK 2.1.G.1). The whole point is that different threats need different defenses, and no single control covers everything. So you combine controls that protect confidentiality, integrity, and availability (the CIA triad), and you mix control types so each threat meets the tool best suited to stop it (EK 2.1.G.2). The payoff is resilience. When one control gets bypassed, another can still block access or shrink the harm (EK 2.1.G.3).
This is the capstone idea of Unit 2: Securing Spaces, and it gets its own learning objective, AP Cybersecurity 2.1.G: "Explain why a defense-in-depth security strategy is necessary to optimally protect an organization." Everything earlier in topic 2.1 builds toward it. You learn the adversaries (2.1.B), the phases of an attack (2.1.C), how risk works (2.1.D), and the types of security controls (2.1.F). Defense in depth is the strategy that ties all of those together. The exam wants you to explain WHY layering matters, not just define it, so understanding the reasoning about resilience and threat-matching is what scores points.
Keep studying AP Cybersecurity Unit 2
Visual cheatsheet
view galleryTypes of security controls (Unit 2)
Defense in depth is meaningless without controls to layer. The control types from 2.1.F are the actual bricks, and defense in depth is the strategy for stacking them so each threat meets the control best built to stop it.
The CIA triad (Unit 2)
Every layer you add is protecting confidentiality, integrity, or availability. Defense in depth works because you can stack controls that each guard a different leg of the triad instead of betting everything on one.
Phases of a cyberattack (Unit 2)
Attacks unfold in phases like reconnaissance, initial access, and lateral movement. Layered defense gives you a chance to catch or slow an adversary at each phase, so getting past initial access doesn't mean they reach your data.
Risk mitigation (Unit 2)
Of the four risk responses (avoid, transfer, mitigate, accept), defense in depth is mitigation done right. You're stacking controls to lower both the likelihood and the impact of an attack on a vulnerability.
Expect 2.1.G to show up as a "why" question, not just a "what." Multiple-choice stems may describe a scenario where one control fails and ask which strategy still protects the data, or ask you to pick the reason layering beats a single strong control. The answer almost always points to resilience: when one layer is bypassed, another still stands (EK 2.1.G.3). On a free-response prompt, you'd be expected to explain that different threats need different controls and that layering provides backup, then apply it to the scenario given. Lead with the resilience and threat-matching reasoning rather than just naming controls.
These are the same thing. The CED uses "defense in depth" and "layered defense" as interchangeable names for one strategy (EK 2.1.G.1), so don't treat them as two separate concepts on the exam.
Defense in depth (layered defense) stacks multiple types of security controls instead of relying on a single one.
Its core benefit is resilience: if an adversary bypasses one control, another can still block access or limit the damage.
Different threats need different controls, so layering lets you match the best-suited control to each threat.
It directly supports learning objective 2.1.G, which asks you to EXPLAIN why this strategy is necessary, not just define it.
Layered defense is the practical form of risk mitigation, lowering both the likelihood and the impact of an attack.
It's a security strategy that uses multiple types of controls layered together so that if one is bypassed, another can still protect your data or limit the harm. It's defined in learning objective 2.1.G and is sometimes called layered defense.
Yes. The CED uses both terms for the exact same strategy (EK 2.1.G.1), so if a question mentions either name, it's talking about the same idea.
Because no single control stops every threat, and any control can fail or be bypassed. Defense in depth gives you backup layers, so one failure doesn't expose your whole system, which is the resilience point in EK 2.1.G.3.
Risk mitigation is the broad strategy of using controls to reduce a risk's likelihood or impact. Defense in depth is a specific way to do that by stacking multiple controls in layers rather than using just one.
Each layer you add protects confidentiality, integrity, or availability. Layering lets you cover all three at once instead of leaving one leg of the triad guarded by a single control.
Connect this key term to the AP exam workflow: review the course, practice questions, and check related study tools.