Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Perimeter Layer Protection at the Azure Network Edge
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An organization is implementing a defense-in-depth strategy to protect its cloud workloads in Azure.
The security team needs to implement controls that filter external traffic at the network edge and protect cloud services from large-scale Distributed Denial of Service (DDoS) attacks before malicious requests can reach internal virtual networks.
Which layer of the defense-in-depth model addresses these requirements?
Explanations
Compute layer
Compute layer
What the Compute Layer Is
The compute layer focuses on securing virtual machines, container runtimes, host operating systems, and application execution environments.
Why It Doesn't Meet the Requirement
The compute layer protects endpoints and servers internally; it does not manage boundary traffic or provide perimeter-level flood mitigation. Relying on compute resources to absorb DDoS attacks leaves virtual machines exposed and vulnerable to resource exhaustion.
Key Characteristics and Limitations
- Enforces operating system patch management and regular vulnerability scanning.
- Employs endpoint protection such as Microsoft Defender for Servers and antimalware agents.
- Utilizes mechanisms like Trusted Launch, Secure Boot, and Just-In-Time (JIT) VM access to harden host instances.
This Answer Would Be Correct If
The organization needed to secure virtual machines against malware, patch operating system vulnerabilities, or limit administrative port exposure via Just-In-Time (JIT) access.
Identity and access layer
Identity and access layer
What the Identity and Access Layer Is
The identity and access layer manages user and workload verification, authentication, and authorization policies across cloud services.
Why It Doesn't Meet the Requirement
While critical for securing resource access, this layer evaluates credentials, identity tokens, and access policies rather than filtering network-level packet streams or mitigating volumetric DDoS attacks at the network perimeter.
Key Characteristics and Limitations
- Controls access using Microsoft Entra ID and role-based access control (Azure RBAC).
- Enforces security controls such as Multi-Factor Authentication (MFA) and Conditional Access policies.
- Utilizes managed identities for secure, credential-free communication between services.
This Answer Would Be Correct If
The organization required users to perform multi-factor authentication or needed to grant granular administrative permissions to cloud resources using role-based access control.
Data layer
Data layer
What the Data Layer Is
The data layer is the innermost layer of the defense-in-depth hierarchy. Its primary purpose is to safeguard raw data, files, and databases from unauthorized access, modification, or exposure.
Why It Doesn't Meet the Requirement
The data layer does not inspect incoming network traffic or mitigate edge-level distributed attacks. Instead, it relies on cryptographic mechanisms such as Transparent Data Encryption (TDE), Azure Storage encryption at rest, and access keys to ensure data confidentiality and integrity.
Key Characteristics and Limitations
- Enforces encryption for data at rest, in transit, and in use.
- Manages keys, secrets, and certificates using services like Azure Key Vault.
- Focuses on file systems, relational databases, and object stores rather than inbound internet packets.
This Answer Would Be Correct If
The organization needed to encrypt database storage files on disk using Transparent Data Encryption or protect blob storage containers with Shared Access Signatures (SAS).
Perimeter layer
Perimeter layer
What the Perimeter Layer Is
The perimeter layer is the boundary in the defense-in-depth model focused on protecting an organization's network edge from external, internet-based threats. It serves as the initial line of defense against network-wide disruptions and unauthorized external traffic.
How It Meets the Requirements
- DDoS Mitigation: By placing Azure DDoS Protection at the perimeter, organizations can detect and absorb large-scale volumetric traffic floods before they saturate network resources.
- Edge Filtering and Inspection: Utilizing tools like Azure Firewall or Network Virtual Appliances (NVAs) in a perimeter network (DMZ) enables packet inspection and filtering of external traffic before it ever enters internal subnets.
Key Capabilities
- Mitigates network-level and transport-level DDoS attacks automatically.
- Filters inbound and outbound traffic through centralized firewall rules and threat intelligence.
- Protects web applications at the edge using Web Application Firewall (WAF) capabilities.
- Isolates public entry points from internal resources through perimeter networks (DMZs).
Why This Is Optimal
The perimeter layer stops attacks at the external boundary before they can consume internal compute, network, or storage resources, preventing downstream service outages across the entire architecture.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense in Depth Layers
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth Model
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Pricing Calculator
Compare cloud pricing models
IntermediateAZ-400 Designing and Implementing Microsoft DevOps Solutions Exam
GitHub Branch Protection Rules and SAML SSO
Design and implement permissions and roles in GitHub
Last updated Validated