An enterprise wants to adopt a security architecture where no user or device is inherently trusted and access is continuously verified, combined with multiple overlapping protective measures. Which pair of layered defense strategies best matches this goal, according to information security fundamentals?