Describe the concept of defense sequencing and give an example.

• A. Prioritizing protective measures by risk, such as segmenting the network first, then deploying EDR, then patching critical systems.
• B. Installing all controls simultaneously.
• C. Focusing only on detection tools before prevention.
• D. Removing older controls before adding new ones.

Answer: (A)

Defense sequencing means putting security controls in a risk-based order, so the highest-risk gaps are closed first and the defense builds outward in a practical, layered way. In this approach, starting with network segmentation limits how far an attacker can move laterally, effectively shrinking the blast radius if a breach occurs. Next, deploying endpoint detection and response adds visibility and rapid containment capabilities on individual devices, so threats are detected and stopped before they spread. Finally, patching critical systems reduces the number of exploitable weaknesses an attacker could use, addressing underlying vulnerabilities that could be exploited after initial access is gained.

This order makes sense because it prioritizes reducing exposure first, then improving detection and response, and finally hardening the environment by fixing vulnerabilities. The other options miss this balanced, prioritized progression: installing controls all at once is often impractical and can leave gaps during rollout, focusing only on detection ignores preventive measures, and removing older controls before adding new ones weakens protection and disrupts defense-in-depth.