(A) Incorrect — cost savings are not a security justification for layered defense.

(C) Incorrect — antivirus does not improve performance; it provides malware detection.

(D) Incorrect — vendor bundle pricing is a procurement decision, not a security justification.

(B) Incorrect — no security architecture guarantees invulnerability; defense-in-depth increases difficulty and detection probability.

(C) Incorrect — each layer should be as effective as possible; partial effectiveness at every layer is not the design goal.

(D) Incorrect — while due diligence matters legally, defense-in-depth is a security strategy, not a legal strategy.

(A) Incorrect — cameras and badge readers are physical; penetration testing and visitor logs are administrative; only encryption and IDS are technical.

(B) Incorrect — penetration testing (a scheduled assessment procedure) and visitor sign-in logs (a policy requirement) are administrative controls.

(D) Incorrect — individual controls compose defense-in-depth layers when deployed together across multiple categories.

(A) Incorrect — while least privilege is relevant, the scenario specifically illustrates the danger of an unprotected layer.

(C) Incorrect — separation of duties is about dividing responsibilities, not about security awareness training.

(D) Incorrect — defense-in-depth requires ALL layers to be addressed; strong technical controls cannot fully compensate for zero human-layer protection.

(A) Incorrect — there is no universal “sufficient” number of layers; adequacy depends on context.

(C) Incorrect — the OSI model describes networking layers, not security layers; there is no requirement to match them.

(D) Incorrect — defense-in-depth is proactive; waiting until after a breach to add layers is reactive and inadequate.