Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Layered Security Containment When One Control Fails
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is hosting a multi-tier web application in Azure that processes sensitive customer records. To protect the environment against security breaches, the cloud architect deploys edge protection with a Web Application Firewall (WAF), configures Network Security Groups for virtual networks, enforces strict identity controls with Multi-Factor Authentication (MFA), and enables data encryption at rest.
What is the primary benefit of implementing this defense-in-depth strategy?
Explanations
It guarantees absolute immunity from cyberattacks and removes the necessity to monitor telemetry logs.
It guarantees absolute immunity from cyberattacks and removes the necessity to monitor telemetry logs.
What This Option Represents
This option suggests that layered security creates an impenetrable barrier that guarantees complete protection from all potential threats, rendering operational monitoring obsolete.
Why It Does Not Meet the Requirement
No security architecture or framework can guarantee total immunity against sophisticated cyber threats or zero-day vulnerabilities. Furthermore, defense-in-depth relies heavily on continuous telemetry logging, auditing, and monitoring across all layers to detect anomalous behavior and respond promptly to potential incidents.
Key Characteristics and Limitations
- Continuous monitoring necessity: Visibility through logs and alerts is required to verify whether security controls are functioning as intended.
- Evolving threat landscape: Attack techniques constantly evolve, making absolute security guarantees unrealistic.
- Detection and response focus: Layered defense is designed to delay attackers and provide opportunities for detection rather than asserting invulnerability.
This Answer Would Be Correct If
A system operated in total isolation with deterministic static rules where active monitoring and adaptive response were technically unfeasible, though this does not apply to enterprise cloud environments.
Additional Context
Believing that multi-layered security replaces active threat monitoring is a dangerous security misconception; layered architectures generate valuable telemetry that enhances incident response capabilities.
It consolidates all cloud resources into a single broad network perimeter to minimize latency and management overhead.
It consolidates all cloud resources into a single broad network perimeter to minimize latency and management overhead.
What This Option Represents
This option describes a flat or consolidated network model where resources reside within a single perimeter to simplify administrative overhead and eliminate routing hops.
Why It Does Not Meet the Requirement
A defense-in-depth architecture intentionally avoids flat network designs. Consolidating all services into a single perimeter creates a critical single point of failure; once an attacker penetrates the perimeter, they gain unrestricted access to all internal resources.
Key Characteristics and Limitations
- Lack of segmentation: Flat networks allow unrestrained lateral movement for threats inside the environment.
- Elevated blast radius: A breach of any individual service can compromise all adjacent resources.
- Contradicts layered design: Defense-in-depth mandates granular boundaries, such as subnets, micro-segmentation, and application firewalls.
This Answer Would Be Correct If
The goal was to optimize purely for minimal inter-service latency in non-sensitive testing environments where security isolation was not a consideration.
Additional Context
Implementing multiple layers like Azure Front Door alongside internal Application Gateway instances introduces structured inspection points that strengthen protection despite adding architectural components.
It provides multiple coordinated security layers so that if a single control is compromised, subsequent layers prevent unauthorized access.
It provides multiple coordinated security layers so that if a single control is compromised, subsequent layers prevent unauthorized access.
What Defense-in-Depth Is
Defense-in-depth is a comprehensive cybersecurity strategy that employs a series of layered defense mechanisms to protect sensitive data and infrastructure. Rather than relying on a single defensive boundary, defense-in-depth creates multiple independent levels of security across physical, identity, perimeter, network, compute, application, and data layers.
How It Meets Security and Resilience Requirements
The primary objective of a defense-in-depth model is to slow down or halt attackers who attempt to gain unauthorized access to an environment. If an adversary manages to bypass or compromise an outer layer—such as exploiting a vulnerability in a public web endpoint—the remaining interior controls (such as network segmentation, role-based access control, and data encryption) continue to restrict lateral movement and prevent unauthorized data exfiltration.
Key Advantages and Capabilities
- Enhanced threat protection: Protects against a wide variety of attack vectors across multiple infrastructure levels.
- Improved incident response: Provides security teams with critical telemetry and detection points at each layer, enabling faster containment of threats.
- Increased resilience: Eliminates single points of failure within the organizational security posture.
- Mitigation of human error: Ensures that misconfigurations at one level do not completely expose the entire environment.
Why This Approach Is Optimal
Modern cloud architectures cannot depend solely on perimeter firewalls. Adopting a layered defense ensures that each component assumes potential breach conditions and independently validates and protects assets, maximizing overall cloud workload safety.
It replaces identity and access management controls with network-level packet filtering across all workloads.
It replaces identity and access management controls with network-level packet filtering across all workloads.
What This Option Represents
This option describes relying strictly on network-layer mechanisms (such as IP packet filtering and firewall rules) while disregarding identity-centric security measures.
Why It Does Not Meet the Requirement
Defense-in-depth does not replace identity controls; instead, it considers identity to be the primary security perimeter in cloud environments. A complete defense-in-depth strategy incorporates identity and access management (IAM) alongside network, application, and data controls.
Key Characteristics and Limitations
- Identity as a primary layer: Network filters cannot inspect identity tokens or enforce multi-factor authentication requirements.
- Zero Trust alignment: Modern security models require explicit verification of identity for every access request, regardless of network location.
- Holistic coverage: Omitting identity protections exposes systems to credential theft and unauthorized access via authorized network ports.
This Answer Would Be Correct If
The scenario focused exclusively on basic Layer 3/Layer 4 routing boundaries without any user authentication or access governance requirements.
Additional Context
A comprehensive defense strategy combines edge services like Web Application Firewall (WAF) with robust identity safeguards such as Azure Role-Based Access Control (Azure RBAC).
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense in Depth Layers
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth Model
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Blob Archive Tier
Describe storage tiers
IntermediateAZ-204 Developing Solutions for Microsoft Azure Exam
Azure Blob System Properties vs User-Defined Metadata
Set and retrieve properties and metadata
Last updated Validated