Which statement best describes a defensible architecture requirement?

• A. Optimizing performance at the expense of security.
• B. Using a single vendor for all components.
• C. Eliminating patch management for speed.
• D. Secure defaults, validated components, and robust monitoring.

Answer: (D)

Defensible architecture focuses on designing a system that starts secure, remains controllable, and is easy to defend under real-world conditions. The statement that emphasizes secure defaults, validated components, and robust monitoring captures this approach: secure defaults ensure every new deployment begins from a safe baseline, validated components mean each piece has been checked for security properties and known risks, and robust monitoring provides visibility, early detection, and rapid response to incidents. Together these elements create a resilient, auditable, and actionable security posture.

Why the other ideas don’t fit: prioritizing performance over security leaves critical protections out of the design, creating exploitable gaps. Relying on a single vendor introduces supply chain risk and potential single points of failure. Eliminating patch management removes a primary defense against known vulnerabilities, undermining the system’s ability to stay secure over time.