SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security analyst is explaining the concept of 'defense in depth' to a new team member. Which of the following best describes the defense in depth strategy?
⚠ Common exam trap
Test-takers frequently confuse 'defense in depth' with 'layered security' but then incorrectly select a single-layer option like a strong firewall (A) because they think a robust perimeter is sufficient, failing to recognize that the strategy explicitly requires multiple independent and overlapping controls.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing multiple layers of security controls to protect assets
Defense in depth is a cybersecurity strategy that employs multiple layers of security controls across different parts of an IT environment (network, endpoint, application, data) to ensure that if one layer fails, another layer is already in place to mitigate the threat. This approach is fundamental to Microsoft's security architecture, as seen in products like Microsoft Defender for Cloud, which integrates protections across workloads, and Azure Active Directory (now Microsoft Entra ID), which layers conditional access policies on top of identity verification. Option B correctly captures this layered, redundant approach rather than relying on a single point of defense.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using a single strong firewall to protect all network traffic
Why it's wrong here
A single strong firewall, while essential for perimeter security, constitutes only one layer of defense. Defense in depth mandates a multi-faceted approach, meaning that relying solely on a firewall leaves internal networks, hosts, applications, and data vulnerable once the perimeter is breached. This strategy lacks the necessary overlapping controls to provide resilience against sophisticated attacks.
- ✓
Implementing multiple layers of security controls to protect assets
Why this is correct
Implementing multiple layers of security controls is the core principle of defense in depth. This strategy involves strategically placing diverse, independent security mechanisms—such as physical security, network segmentation, host-based firewalls, application security, and data encryption—to create redundancy. Each layer is designed to detect, delay, or prevent an attacker from reaching critical assets, even if a preceding layer is compromised.
- ✗
Relying on user training as the primary security measure
Why it's wrong here
While crucial for fostering a security-aware culture and mitigating human error, user training alone is insufficient as a primary security measure for defense in depth. It addresses the human element but does not provide the technical, automated, or physical barriers required to protect systems and data from direct technical exploits or sophisticated attacks. Defense in depth necessitates a robust framework of technical controls complementing human vigilance.
- ✗
Applying encryption only to data at rest
Why it's wrong here
Applying encryption only to data at rest protects information when it is stored on persistent media, safeguarding against unauthorized access to databases or storage devices. However, this single control neglects other critical states of data, such as data in transit over networks or data actively in use by applications. A true defense-in-depth strategy for data protection requires comprehensive encryption across all states, combined with access controls, monitoring, and other layered safeguards.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Threat
A threat is any potential danger that could harm a computer system, network, or data, whether from a malicious hacker, a natural disaster, or an accidental mistake.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.