DRAG DROP You need to complete the defense-in-depth strategy used in a datacenter, What should you do? To answer, drag the appropriate layers to the correct positions in the model. Each layer may be used once, more than once, or not at all. NOTE: Each correct selection is worth one point.

The diagram illustrates the defense-in-depth model, a strategy that layers multiple, independent security controls to protect assets. The layers are arranged from the outermost barrier (top) to the core asset being protected (bottom).

1. Physical Security: This is the outermost layer, providing the first line of defense. It includes controls like guards, fences, and locked doors to prevent unauthorized physical access to the datacenter and hardware.
2. Perimeter: This layer is placed between the "Identity & Access" and "Network" layers. It represents the network edge, using controls like firewalls and Distributed Denial of Service (DDoS) protection to defend against large-scale network-based attacks.
3. Application: This layer is placed between the "Compute" and "Data" layers. It focuses on securing applications (e.g., through secure coding, Web Application Firewalls) as they are the direct gateway to accessing and processing the data.

The final, correct order from outer to inner is: Physical Security > Identity & Access > Perimeter > Network > Compute > Application > Data.

Microsoft Learn. (n.d.). What is defense in depth?. Microsoft Azure Documentation.

This document outlines the standard layered security model used by Microsoft. It explicitly details the order and purpose of each layer: "The layers are: physical security, identity and access, perimeter, network, compute, application, and data." This directly supports the placement of all three draggable layers in the provided diagram.

National Security Agency (NSA). (n.d.). Defense in Depth: A practical strategy for achieving Information Assurance in today's highly networked environments.

This foundational document (referenced in academic texts, e.g., Wikipedia "Defense in depth (computing)") establishes the "onion model" concept. It describes the layering of defenses, starting with Physical Security as a fundamental component, followed by network and host-level controls (like Perimeter and Compute), and finally protecting the Application and Data at the core.

National Institute of Standards and Technology (NIST). (n.d.). Glossary: Defense-in-Depth. Computer Security Resource Center (CSRC).

Document: NIST SP 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations.

Reference: This standard, along with the CSRC glossary, defines defense-in-depth as an "information security strategy integrating people, technology, and operations capabilities to establish variable barriers across multiple layers and dimensions of the organization." The layered model in the question is a direct visualization of implementing these variable barriers, which include physical, network (perimeter), and application controls as distinct layers.