Fundamental
Prepare and test your skills
Fundamental
Prepare and test your skills
Layered Azure Security Across Network Identity and Data
Free sample question, answered and explained below. The AZ-900 Microsoft Azure Fundamentals Exam practice bank has 688 more like it. Try 10 free: instant score, no account.
An enterprise is deploying a mission-critical financial application on Azure Virtual Machines that processes confidential client records. The security team wants to adopt a defense-in-depth security approach to protect the workload and ensure that a single point of failure cannot compromise the entire environment.
Which approach best demonstrates applying a defense-in-depth strategy across multiple security layers in Azure?
Explanations
Relying exclusively on IP-based access control lists on the public load balancer without requiring identity authentication or transport encryption
Relying exclusively on IP-based access control lists on the public load balancer without requiring identity authentication or transport encryption
What This Option Is
This configuration represents a single-perimeter defense model that uses IP-based access control lists (ACLs) or network filtering rules as the only line of defense, leaving downstream layers unprotected by identity validation or encryption.
Why It Doesn't Meet the Requirement
- Violates Defense in Depth: Relying solely on IP address filtering leaves resources vulnerable if an attacker spoofs an IP address, compromises an authorized corporate endpoint, or launches an insider attack.
- Lacks Identity Controls: Network perimeter rules do not authenticate individual users or verify caller permissions.
- Omits Data Protection: Without TLS encryption in transit, data passing across the network is vulnerable to interception and inspection.
Key Limitations
- Single Point of Failure: A breach of the network perimeter immediately compromises the underlying resources.
- No Authorization Granularity: Network access controls cannot distinguish between legitimate user actions and unauthorized administrative tasks.
- Vulnerable to Address Spoofing: IP-based access lists alone cannot validate application-level trust or prevent session hijacking.
This Answer Would Be Correct If
A scenario asked about a basic network perimeter filter aimed strictly at restricting source IP ranges, without requiring a comprehensive defense-in-depth strategy.
Additional Context
Best practices highlight that while IP-based ACLs and service tags are useful for restricting network traffic, they should never serve as the only layer of defense; organizations must always pair them with strong authentication and cryptographic protections.
Combining Network Security Groups for traffic filtering, role-based access control with authentication for identity security, and encryption for data at rest and in transit
Combining Network Security Groups for traffic filtering, role-based access control with authentication for identity security, and encryption for data at rest and in transit
What Defense in Depth Is
Defense in depth is a fundamental security architecture strategy that manages organizational risk by deploying multiple independent, diverse defensive mechanisms across several layers. Rather than relying on a single security perimeter, defense in depth creates layered barriers around critical assets—including physical security, identity and access, network perimeters, compute infrastructure, applications, and core data. If any single layer is bypassed or compromised, subsequent layers prevent unauthorized access and minimize overall blast radius.
How It Meets the Requirements
This approach aligns directly with defense-in-depth principles by establishing independent security controls across critical architectural tiers:
- Network Layer: Network security groups (NSGs) restrict inbound and outbound traffic flows and minimize the public attack surface area by closing unnecessary listening ports.
- Identity and Access Layer: Azure role-based access control (Azure RBAC) and robust identity authentication ensure only authorized users and workloads with verified permissions can interact with resources.
- Data Layer: Enforcing encryption at rest (using standards like AES-256) and encryption in transit (using TLS) ensures data confidentiality even if physical media or network packets are intercepted.
Key Advantages and Capabilities
- Redundant Protection: Prevents a complete system breach if an attacker bypasses one defensive control (such as gaining network access).
- Attack Surface Reduction: Closes non-essential ports and IP address ranges using granular network filtering.
- Strong Authentication: Replaces reliance on network origin alone with cryptographic identities and role assignments.
- End-to-End Data Safeguards: Protects stored databases and transmitted traffic against unauthorized inspection or tampering.
Why This Is Optimal
Layering network filtering, identity governance, and cryptographic controls ensures that security is holistic. It protects the financial application across the compute, network, identity, and data layers, delivering complete compliance with Azure best practices.
Disabling automated key rotation and backups in Azure Key Vault so that encryption keys and database secrets remain static
Disabling automated key rotation and backups in Azure Key Vault so that encryption keys and database secrets remain static
What This Option Is
This configuration represents a static credential management practice where cryptographic keys, connection strings, and application secrets are never rotated, and automated data backups are disabled.
Why It Doesn't Meet the Requirement
- Increases Long-Term Exposure: Secrets and keys are susceptible to leakage or inadvertent exposure over time; keeping them static increases the window of vulnerability.
- Violates Data Recovery Benchmarks: Disabling automated backups leaves the organization unable to recover data in the event of ransomware, corruption, or accidental deletion.
- Fails Operational Best Practices: Azure security guidance mandates regular automated backups and key lifecycle management.
Key Limitations
- Higher Breach Impact: If a static key is leaked, unauthorized actors retain permanent access until a manual intervention occurs.
- Lack of Disaster Recovery: Without regular backups, business continuity objectives cannot be met.
- Absence of Audit Assurance: Fails compliance mandates that require demonstrable secret lifecycle governance.
This Answer Would Be Correct If
A scenario required demonstrating an insecure configuration that heightens credential exposure and introduces severe operational risk.
Additional Context
Proper secret management in Azure incorporates Azure Key Vault with automated key rotation, soft-delete protection, purge protection, and regular automated backups to ensure both data protection and disaster recovery resilience.
Hosting all web, application, and database tiers on a single virtual machine to centralize all security configurations in one location
Hosting all web, application, and database tiers on a single virtual machine to centralize all security configurations in one location
What This Option Is
This architecture is a monolithic deployment where the presentation layer, business logic layer, and database storage reside on one virtual machine instance.
Why It Doesn't Meet the Requirement
- Eliminates Layered Isolation: Combining all application tiers into a single host removes network segmentation boundaries, meaning a compromise of the public web front-end immediately compromises the database.
- Increases Single Point of Failure Risk: If the host experiences an operating system failure, software fault, or security exploit, the entire application becomes unavailable.
- Precludes Granular Role Separation: It prevents administrators from enforcing least-privilege network rules between tiers.
Key Limitations
- High Blast Radius: Web-tier vulnerabilities provide direct local access to sensitive backend database files and credentials.
- Poor Scalability: Tiers cannot scale out independently based on variable workload demand.
- Absence of Micro-Segmentation: Eliminates the ability to use dedicated subnets and Network Security Groups between tiers.
This Answer Would Be Correct If
The objective were to minimize operational complexity and cloud cost for a lightweight, non-production prototype or development environment.
Additional Context
A defense-in-depth architecture utilizes multi-tier subnetting inside an Azure Virtual Network, isolating front-end subnets from backend data subnets with dedicated NSGs and private endpoints.
Try 10 interactive questions like this one, free
Answer them yourself and get your score the moment you finish. No account needed.
Full access includes
- 688 practice questions across all 3 exam domains
- Every answer explained: why it is right, and why the others are not
- Scout, an AI tutor that answers your follow-up questions
- Readiness tracking by domain, so you know when to book the exam
Related questions
Keep the momentum going with these hand-picked practice scenarios
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Defense-in-Depth Perimeter Layer
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth Model
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Defense-in-Depth
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Microsoft Defender for Cloud
Describe the purpose of the defense-in-depth model
FundamentalAZ-900 Microsoft Azure Fundamentals Exam
Azure Pipelines IaC CI/CD Automation
Describe infrastructure as code (IaC)
ExpertAZ-305 Designing Microsoft Azure Infrastructure Solutions Exam
Azure Container Apps vs AKS
Recommend a container-based solution
Last updated Validated