AZ-900 Describe cloud concepts Practice Question
What is 'defense in depth' in cloud security?
⚠ Common exam trap
Watch out — candidates often confuse defense in depth with a single strong security measure (like encryption or strong passwords) or with unrelated concepts like geographic redundancy, rather than recognizing it as a layered, multi-control strategy.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A layered security approach where multiple defenses protect assets
Defense in depth is a layered security strategy that uses multiple, independent security controls across different layers of the IT stack (network, compute, storage, application, data) to protect assets. If one layer is breached, additional layers are in place to prevent or limit further compromise. This approach is fundamental to Azure's security architecture, where tools like Azure Firewall, Network Security Groups (NSGs), Azure Policy, and Azure Defender work together to provide overlapping protections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using a very strong single password for all Azure accounts
Why it's wrong here
Using a very strong single password for all Azure accounts creates a single point of failure that contradicts defense in depth. If that password is phished, brute-forced, or leaked, an attacker gains unrestricted access to every resource without facing additional barriers. Defense in depth instead requires multiple layers of identity verification, such as multi-factor authentication and conditional access policies, to ensure that compromising one credential is not enough to breach the environment.
- ✓
A layered security approach where multiple defenses protect assets
Why this is correct
Defense in depth is a layered security approach in which multiple independent defenses protect assets, so that if one control fails, others continue to provide protection. This strategy spans physical security, identity and access management, network security, and data encryption, each addressing different attack vectors. The overlapping nature of these controls forces an attacker to defeat several distinct mechanisms to reach the target, significantly raising the cost and complexity of an attack.
- ✗
Storing data in multiple geographic locations for backup
Why it's wrong here
Storing data in multiple geographic locations for backup primarily addresses availability and disaster recovery, not security. Geo-replication creates redundant copies across regions to withstand a regional outage, but it does not add a meaningful layer of defense against unauthorized access. In contrast, defense in depth is a security architecture that deliberately layers independent controls—such as firewalls, identity verification, and access policies—so that no single shortcoming exposes the asset.
- ✗
Using the most advanced encryption for all Azure data
Why it's wrong here
Using the most advanced encryption for all Azure data is an important data-level control, but it represents only one layer in a defense-in-depth strategy. Even robust encryption cannot prevent a compromised user account from being misused, nor does it block malicious network traffic or application-layer attacks. A complete security posture must combine encryption with identity governance, network segmentation, and continuous monitoring to create overlapping safeguards.
Go deeper
Related to this question
Learn chapter
What is Cloud Computing?
Key term
Azure Firewall
Azure Firewall is a cloud-based network security service that protects your virtual networks in Microsoft Azure by filtering traffic based on rules you define.
Key term
Azure Policy
Azure Policy is a service in Microsoft Azure that lets you create, assign, and manage rules to ensure your resources stay compliant with your company standards and service-level agreements.
About these practice questions
This AZ-900 question is part of Courseiva's 981-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This AZ-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the AZ-900 exam.