A parks department relies only on a strong password for a public-facing app and calls that defense-in-depth. What is wrong with that claim?
Select an answer to reveal the explanation.
Short Explanation
One strong password is still one layer—like one lock on a glass door. Defense-in-depth means stacking controls so a password failure is not game over. Strong secrets help, but they are not a whole layered program.
Full Explanation
Defense-in-depth requires multiple complementary controls so that compromise of one does not equal total failure. A parks department that relies only on a strong password for a public-facing app has a single control—credential strength—regardless of how complex that password is. Public-facing apps typically need layered protections such as strong authentication (often MFA), application-level safeguards, network and edge protections where appropriate, monitoring, and hardened data storage. Calling a lone password “defense-in-depth” misuses the term and understates residual risk.
Strong passwords do not automatically create seven independent security layers. Defense-in-depth does not forbid passwords or mandate biometrics exclusively; passwords can remain one layer among others. A strong password is still useful for a public-facing app, but usefulness of one control does not equal a layered architecture.
Exam caveat: watch for distractors that equate “strong” with “enough.” AZ-900 wants the recognition that layers matter more than intensifying a solitary control.
Operational check: list every control currently protecting the parks app; if the list is essentially “password,” add at least identity MFA/Conditional Access and a data or application control, then retest sign-in and abuse cases before claiming defense-in-depth.