Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Layered Protection With Defense in Depth
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is designing its cloud security architecture in Azure to safeguard sensitive workloads and customer data against sophisticated cyber threats.
Rather than relying exclusively on perimeter firewalls, the security team implements coordinated controls across identity, network, compute, application, and data layers.
What is the primary objective of implementing this defense-in-depth approach?
Explanations
To replace all logical identity and software access controls with physical security measures inside cloud datacenters
To replace all logical identity and software access controls with physical security measures inside cloud datacenters
What Physical Security Measures Are
Physical security involves hardware-level protections at cloud datacenters, including biometric access gates, security guards, perimeter fencing, surveillance cameras, and strict environmental monitoring controls. In the cloud shared responsibility model, physical datacenter security is managed entirely by the cloud provider.
Why It Doesn't Meet the Requirement
Physical security represents only the foundational layer of a security model. It cannot protect cloud services against logical, remote cyber attacks such as phishing, credential stuffing, SQL injection, or unauthenticated API calls. Replacing software-based controls with physical measures would leave cloud-hosted applications and data exposed to anyone connecting over the internet.
Key Characteristics and Limitations
- Protects only physical infrastructure: Prevents unauthorized physical access to server racks, cabling, and storage drives.
- Ineffective against remote threats: Provides zero protection against network-based cyberattacks, ransomware, or identity theft.
- Managed by the cloud provider: Cloud customers cannot rely on physical security alone to manage access to their software and digital assets.
This Answer Would Be Correct If
The scenario asked specifically about how the cloud provider secures the tangible hardware facilities and server buildings against on-site intruders.
To eliminate the need for endpoint security and user authentication by establishing a fully impenetrable outer network perimeter
To eliminate the need for endpoint security and user authentication by establishing a fully impenetrable outer network perimeter
What Perimeter-Only Security Is
Perimeter-only security is a legacy security approach that focuses protection exclusively at the outer network boundary (such as traditional edge firewalls), operating under the assumption that everything inside the network is trusted and secure.
Why It Doesn't Meet the Requirement
This approach directly contradicts the core principles of defense-in-depth and modern cloud security. No single perimeter can be completely impenetrable, especially given threats such as compromised user credentials, phishing campaigns, zero-day vulnerabilities, and authorized insiders with malicious intent. Relying solely on an outer boundary leaves interior resources completely defenseless once the outer perimeter is breached.
Key Characteristics and Limitations
- Single point of failure: If an adversary breaches the edge firewall, all internal data and compute resources become immediately vulnerable.
- Inadequate for cloud environments: Cloud architectures, mobile workforces, and Software-as-a-Service (SaaS) applications render traditional network-only boundaries ineffective.
- Absence of internal controls: Ignores essential safeguards like least-privilege access, host-based endpoint detection, and data encryption.
This Answer Would Be Correct If
The goal was to describe an outdated, single-barrier network design rather than a multi-layered security strategy.
To automatically replicate data and virtual machines across multiple geographic regions to maximize high availability and disaster recovery
To automatically replicate data and virtual machines across multiple geographic regions to maximize high availability and disaster recovery
What High Availability and Geo-Replication Are
Geo-replication and high availability architectures are business continuity mechanisms designed to duplicate data and compute workloads across multiple cloud regions or availability zones. Their primary purpose is to ensure service uptime and rapid disaster recovery in the event of hardware failures or regional power outages.
Why It Doesn't Meet the Requirement
While high availability is an essential architectural pillar, it addresses reliability and availability, not security and unauthorized access prevention. Replicating compromised or unencrypted data across regions does not mitigate cyber threats; in fact, replicating an infected system without security layers simply distributes the malicious payload or vulnerability to secondary locations.
Key Characteristics and Limitations
- Focuses on uptime: Protects against hardware outages, environmental disasters, and regional disruptions.
- No threat prevention: Does not block malware, restrict user privileges, filter malicious network traffic, or stop data exfiltration.
- Complementary discipline: Operates within the reliability pillar of the cloud architecture framework rather than the security pillar.
This Answer Would Be Correct If
The scenario focused on designing a disaster recovery or business continuity strategy to survive catastrophic regional infrastructure failures.
To provide multiple independent layers of protection so that if one security barrier is breached, subsequent layers prevent unauthorized access and protect critical data
To provide multiple independent layers of protection so that if one security barrier is breached, subsequent layers prevent unauthorized access and protect critical data
What Defense-in-Depth Is
Defense-in-depth is a comprehensive cybersecurity strategy that employs multiple distinct layers of defense around an organization's assets. Rather than relying on a single defensive mechanism—such as an external network perimeter firewall—this model establishes security controls across several levels, including physical security, identity and access management, network perimeter defenses, compute host protections, application controls, and data encryption.
How It Meets the Security Requirements
By implementing multiple independent protection barriers, the defense-in-depth model ensures that if an attacker successfully circumvents one layer (such as exploiting a web vulnerability or obtaining compromised credentials), subsequent layers (such as multi-factor authentication, network segmentation, or data-at-rest encryption) immediately engage to block or contain the intrusion. This layered approach prevents a single point of security failure from compromising critical corporate data.
Key Advantages and Capabilities
- Redundant protection: Guarantees that individual control failures or software misconfigurations do not expose the entire system.
- Threat mitigation and delay: Slows down attackers, increasing the opportunity for detection systems to identify and isolate suspicious behavior.
- Comprehensive risk reduction: Protects against diverse threat vectors, including credential theft, network eavesdropping, malware delivery, and insider threats.
- Granular policy enforcement: Applies context-specific security policies tailored to identities, endpoints, traffic flows, and data repositories.
Why This Is Optimal
Modern cloud architectures span diverse endpoints, distributed services, and remote identities where traditional single-perimeter defenses are insufficient. Defense-in-depth creates a resilient, multi-tiered security posture where each layer catches threats that preceding controls might miss.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense in Depth Layers
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud Capabilities
Describe the purpose of Microsoft Defender for Cloud
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated