Active defense is about reducing risk by design, embedding protections into how a system is built so that even if an attacker breaches outer layers, the impact is limited. Segmentation isolates parts of the network to halt movement, and encryption protects data so it remains unreadable even if accessed. Passive defense, by contrast, focuses on seeing and slowing or stopping attackers as they try to operate—using measures that monitor and respond to activity, such as intrusion prevention systems that can block malicious traffic and deception technologies that mislead and slow down attackers. This pairing fits the idea that proactive, architectural protections aim to minimize risk up front, while detection and disruption measures respond to attacker activity. Other statements stray from that distinction: backups are about recovering from incidents after the fact rather than reducing risk by design, and IDS is a detection tool rather than a primary active defense control. The notion that active defense is for military use or that passive defense is the one that disrupts attackers also misaligns with how these concepts are applied in modern security.

The concept being tested is how security planners name the area beyond a base’s fence line where threats can launch or threaten from a distance. The Base Security Zone is the term used to describe that outward area outside the base perimeter where standoff threats can affect the base, guiding how early warning, sensors, barriers, and response forces are positioned to deter or detect attacks before they reach the perimeter. It focuses on the external threat environment that shapes protective posture, rather than the inner or perimeter-specific aspects of security. Other terms don’t fit as neatly. A Base Perimeter Zone suggests something tied to the inside-to-perimeter boundary rather than the outside threat area. An External Defense Area is vague and not a standard designation for the outer threat zone. An Outer Security Ring is a descriptive phrase but not the commonly used, formal label for the area outside the base perimeter that governs standoff threat planning.

In contested environments, secure communications rely on three pillars: confidentiality, authentication, and robust key management. End-to-end encryption ensures that the content remains unreadable to anyone except the intended recipient, even if the message passes through untrusted or compromised networks. Mutual authentication verifies both parties’ identities, preventing impersonation and man-in-the-middle attacks where an adversary could otherwise insert themselves into the communication. Robust key management covers how keys are created, distributed, stored, rotated, revoked, and destroyed, so a compromised key doesn’t compromise long-term security and new keys can be issued securely. Without authentication, encryption alone can be dangerous because you might be encrypted to an impostor, so you could be sharing secrets with a bad actor. Relying only on perimeter defenses or assuming external networks are trusted leaves internal communications exposed if attackers breach the network or bypass borders. Using plain text removes any confidentiality and makes interception trivial, exposing sensitive information to anyone who can observe the channel.

Controlling who can see information and what they can do with it is the essential idea here. Need-to-know means access to particular information is granted only to people who truly need it to perform their duties, not to everyone who might have a general interest. Least privilege means that once someone has access, they receive only the minimum permissions necessary to carry out their tasks, no more. Together, these principles reduce exposure and limit potential damage from mistakes, misuse, or malicious actions. The described statement captures this accurately: access to information is restricted to what a role requires, and permissions are kept to the minimum needed to perform the job. The other options don’t fit because they imply universal access, broad permissions, or no effect on insider threats, which contradict the purpose of need-to-know and least privilege. For example, in practice, a nurse would only access patient records needed for care, and a user account would avoid unnecessary admin rights.