MSDEVBUILD / azure

Defense in Depth

Physical Identity Perimeter Network Compute & app 🔒DATA ✕ ✕ ✕ ✕ 🚫 attacks blocked
Layer after layer protects the data in the middle. Beat one layer, and the next one is waiting.

😟 THE PROBLEM

One firewall is the only protection, and once it fails everything is exposed.

😊 THE SOLUTION

Protect every layer, from the building to the data.

  • One wall of defence✓ Seven layers of protection
  • Attacks at the edge✓ DDoS Protection and firewalls
  • Data stolen if reached✓ Encryption and access control
🛠️ Solved with: Defense in depth
Module 2: Architecture & Services ⏱ 5 min read Updated 11 Nov 2026

Quick answer

Defense in depth protects information with multiple layers of security, so if one layer is breached, the next one still stops the attacker. The layers, from outside in, are physical security, identity and access, perimeter, network, compute, application and data at the centre.

Exam objective: 2.4.7 Describe the purpose of the defense-in-depth model. (Skills measured as of July 20, 2026)

Start with a question

If the castle has only one wall, what happens when it falls?

The castle falls. Real castles had moats, walls, towers and guards. Defense in depth builds security the same way.

Explain it like I’m 10

The technical explanation

LayerPurposeAzure examples
PhysicalProtect buildings and hardwareMicrosoft datacenter security
Identity and accessControl who gets inEntra ID, MFA, Conditional Access
PerimeterStop network attacks at the edgeDDoS Protection, Azure Firewall
NetworkLimit communicationNSGs, segmentation, private endpoints
ComputeSecure VMs and containersPatching, Defender for Servers, Bastion
ApplicationBuild secure appsSecure code, WAF, Key Vault
DataProtect the information itselfEncryption, access controls, Purview

Real-world business scenario

E-commerce

An online retailer

The problem
A vulnerable web plugin let an attacker into a web server, but no further.
What they used
Layered controls: WAF, NSGs blocking web-to-database access except one port, encrypted database, least-privilege identities.
Why that choice
Each layer contained the attack.
The result
The breach was limited to one server; no customer data was accessed.

When to use it and when not to

✓ Use it when…

  • Always: design every workload with several layers of protection.

✕ Think twice when…

  • Relying on one control, such as only a firewall.
Ready for more?The full lesson adds the technical explanation, when to use it, interview questions and revision notes.

Interview preparation

Say your answer out loud first, then open the model answer. Interviewers care more about your reasoning than the exact words.

Beginner What is defense in depth?

Model answer

Using many layers of security instead of one, like a castle with a moat, walls, guards and a locked vault, so an attacker who gets past one layer still faces the next.

Intermediate Name the layers and an Azure control for each.

Model answer

Physical (Microsoft datacenter security), identity and access (Entra ID, MFA), perimeter (DDoS Protection, Azure Firewall), network (NSGs, segmentation), compute (patching, Defender for Servers, Bastion), application (secure code, WAF, Key Vault secrets) and data (encryption, access controls).

Experienced developer How does defense in depth relate to Zero Trust?

Model answer

They complement each other. Defense in depth describes layering controls; Zero Trust describes how each access decision is made at every layer. A Zero Trust architecture is implemented as layered controls.

Test yourself with exercises

3 original practice questions in the AZ-900 style. Pick your answers, then check them. You will see why each option is right or wrong. Score 75% or more and this topic is marked complete.

Question 1

Question 1 of 3

What is at the centre of the defense-in-depth model?

Question 2

Question 2 of 3

Which layer includes DDoS protection and firewalls at the network edge?

Question 3

Question 3 of 3

What is the purpose of defense in depth?

Quick revision

Key points

  • Multiple layers, so one failure does not expose data.
  • Physical → identity → perimeter → network → compute → application → data.
  • Data is at the centre.

Important terminology

Defense in depth
A layered security strategy with protections at every level.
Perimeter layer
Protection at the edge of the network, such as DDoS protection and firewalls.
Blast radius
How much damage one breach can cause. Layers keep it small.

Common mistakes

  • Thinking a single strong firewall is enough.

Exam tips

  • Know the order of layers and that data is in the middle.

Five quick revision questions

  1. 1.What is at the centre of defense in depth?Show

    Data.

  2. 2.What is the outermost layer?Show

    Physical security.

  3. 3.Which layer includes DDoS protection?Show

    Perimeter.

  4. 4.Which layer includes NSGs?Show

    Network.

  5. 5.Why use many layers?Show

    So that if one fails, others still protect the data.

Official references

Make it stick: play a quick gameSort It, Match the Pairs, Lightning Round and Who Am I? Earn XP and badges. Play ❯

Finished this lesson? Tick it off. Your progress is saved in this browser.

Next up: Microsoft Defender for Cloud