This chapter covers defense-in-depth, a layered security strategy referenced throughout Azure's security guidance. AZ-900 tests this under objective 2.5, complementing the Zero Trust model covered in the previous chapter.
Jump to a section
A simple way to picture Defense-in-Depth
A bank vault isn't protected by a single lock — there's a locked front door, security cameras, a guard, a vault door, and an alarm system, each an independent layer. If one layer fails or is bypassed, the others still stand between an intruder and the valuables. Defense-in-depth applies that same layered thinking to technology security: multiple independent security layers, so a single point of failure doesn't compromise everything.
What defense-in-depth means
Defense-in-depth is a security strategy that uses multiple, independent layers of protection, so that if one layer is bypassed or fails, other layers still provide protection. Rather than relying on a single strong barrier, security is distributed across several different mechanisms.
Common layers in a cloud security model
A typical defense-in-depth approach might include layers like: physical security (data center access controls, covered by Azure itself), identity and access (authentication, RBAC, Conditional Access), network security (firewalls, network security groups), compute security (patched, hardened virtual machines), application security (secure coding practices), and data security (encryption). Each layer addresses a different potential point of failure.
How it relates to the Shared Responsibility Model and Zero Trust
Defense-in-depth complements both the Shared Responsibility Model (covered earlier — different layers may be the provider's or the customer's responsibility depending on the service model) and Zero Trust (covered in the previous chapter — many defense-in-depth layers, like identity verification, put Zero Trust principles into practice at that specific layer).
Why layering matters
No single security control is perfect — a firewall rule might be misconfigured, a credential might be compromised. Defense-in-depth accepts that any individual layer could fail, and relies on the combination of layers to still provide meaningful protection even if one is compromised.
Identify the layers relevant to a workload
Consider identity, network, compute, application, and data layers relevant to the specific workload.
Apply protection at each layer independently
Each layer (RBAC for identity, NSGs for network, encryption for data, and so on) is configured independently, rather than relying on just one layer.
Assume any single layer could fail
Design decisions account for the possibility that any individual layer might be bypassed, relying on the remaining layers to still limit damage.
An organization protecting a sensitive database applies multiple independent layers: network security groups restricting network access, RBAC restricting who can connect, encryption protecting the data at rest, and monitoring to detect unusual access — so a failure or misconfiguration in any single layer doesn't fully expose the data.
Objective 2.5 expects a conceptual understanding of defense-in-depth as a layered security strategy, and awareness of common layers (identity, network, compute, application, data).
A common wrong answer is treating defense-in-depth as a specific Azure product or feature — it's a broader security strategy that spans multiple features and practices working together, not a single tool.
Stable terms: defense-in-depth. Memory trick: defense-in-depth = multiple independent security layers, so one failure doesn't mean total compromise.
Defense-in-depth is a security strategy using multiple independent layers of protection.
Common layers include physical, identity/access, network, compute, application, and data security.
It complements the Shared Responsibility Model and Zero Trust principles covered elsewhere in this guide.
The strategy assumes any single layer could fail, relying on the combination of layers for meaningful protection.
Mistake
Defense-in-depth is a specific Azure product or feature.
Correct
It's a broader security strategy — using multiple independent layers of protection together — implemented through a combination of features and practices, not a single tool.
Mistake
One strong security layer is as good as defense-in-depth.
Correct
The point of defense-in-depth is specifically that no single layer is assumed to be perfect — multiple independent layers together provide more reliable protection than any one strong layer alone.
It's a security strategy that uses multiple independent layers of protection — identity, network, compute, application, and data security, among others — so that if one layer is bypassed, other layers still provide protection.
No — it's a broader security strategy implemented through a combination of features and practices working together, not a single product or tool.
You've just covered Defense-in-Depth — now see how well it sticks with free AZ-900 practice questions. Full explanations included, no account needed.
Done with this chapter?