An architecture protects its edge against volumetric attacks, filters traffic between subnets, runs endpoint protection on its virtual machines, validates input in the application, and encrypts data at rest. Why stack all five when each is meant to work on its own?
Microsoft Certified: Azure Fundamentals (AZ-900), objective architecture-and-services. Azure architecture and services medium
Machine-checked — no person has signed for it. This question was read against the source cited below by an automated pass, which found no contradiction. That is a weaker claim than it sounds: the same kind of process wrote the question, so it can confirm its own mistake.
Treat it as a good draft rather than as settled fact, and read the source below before you rely on it. It is not used in mock exams here — only questions a person has signed for are.
The options
Correct Defence in depth: each layer slows or contains an attack, so a failure or bypass at one layer does not hand over what sits behind it
Correct. Layers are assumed to fail individually, and the design question at each one is what happens after the layer outside it has already failed.
Not correct Redundancy: if one control goes offline the others take over its function so the system stays available
Wrong — that is availability thinking applied to security. These controls do different jobs at different layers; they are not standby copies of each other.
Not correct Compliance: auditors count controls, so more of them scores better
Wrong, and it inverts cause and effect. Frameworks ask for layered controls because layering demonstrably contains breaches, not the other way round.
Not correct Performance: several cheap checks cost less than one thorough check
Wrong. Layered security generally costs performance rather than saving it, and you accept that cost in exchange for containment.
Why
Defence in depth arranges controls in rings around the thing you actually care about: physical security, identity and access, the perimeter, the network, the compute layer, the application, and data at the centre. Each ring buys time and containment for the ones inside it. That is also why the strongest single control is not a substitute — the design assumes each layer will one day be the one that failed.
Where this comes from
- Cited
- Microsoft AZ-900 study guide skill area architecture-and-services.identity-access-security
Practise this
Reading one question is not practice. The trainer will draw a set from objective architecture-and-services and space the ones you get wrong.
Practise Microsoft Certified: Azure Fundamentals (AZ-900)
More questions on this objective
- An image-resizing routine runs for about two seconds whenever a file lands in a storage container — perhaps two hundred times on a busy day, and not at all on a quiet one. The team wants to pay for the work done and maintain no servers. Which compute option fits? machine-checked
- A fifteen-year-old accounting application needs a kernel-level driver, a scheduled task that edits the registry, and a runtime version nobody supports any more. The business wants it running in Azure this quarter with as few code changes as possible. Where does it go? machine-checked
- A team runs nine small services, each with its own conflicting library versions. They want each one packaged with its dependencies, starting in seconds, several to a host, without a separate operating system per service. Which compute type are they describing? machine-checked
- Which TWO of these statements about Azure compute types are true? machine-checked
- A public website runs on four identical virtual machines behind a load balancer. Traffic triples while a television advert airs and falls back an hour later. The team wants instances added and removed automatically against CPU, all built from one image, with nobody clicking. Which option is designed for that? machine-checked
- Three virtual machines form a quorum-based cluster in a region that has no availability zones. You want them placed so that neither a single rack losing power nor a single batch of planned host maintenance can take all three at once. What do you configure? machine-checked