Zero Trust, Defense in Depth, and Microsoft Defender for Cloud

Zero Trust is a philosophy: never trust a request by default, verify it explicitly every time, no matter where it originates. Defense in depth is a structural strategy: stack independent layers of controls so a single breached layer doesn’t expose everything behind it. Microsoft Defender for Cloud is the Azure tool that puts both into practice, scoring your posture and watching for active threats across the layers you’ve built. They answer three different questions — why verify, how to structure controls, and how to measure whether it’s working — and the AZ-900 exam expects you to keep them separate.

Zero Trust: never trust, always verify

The older security model assumed anything inside the corporate network perimeter was safe and anything outside it wasn’t — get past the firewall once, and you were broadly trusted from then on. Zero Trust rejects that assumption entirely. Every access request gets evaluated on its own merits using real signals — identity, device health, location, application — regardless of whether the request originates inside the office or from a laptop at an airport. Network location alone proves nothing.

Three guiding principles hold Zero Trust together, and the exam expects them by name:

• Verify explicitly. Authenticate and authorize using every available signal for every request, not just once at initial connection and never again.
• Use least-privilege access. Grant only the access a task actually requires, ideally just-in-time and time-bound, rather than broad standing permissions held indefinitely.
• Assume breach. Design as though an attacker may already have a foothold somewhere in the environment. This drives network segmentation and continuous monitoring specifically to limit blast radius, not just to prevent the initial intrusion.

In practice, Zero Trust for an internal application looks like layering independent signals rather than trusting any single one: MFA to verify identity, a Conditional Access policy checking device compliance to verify device health, and network segmentation so the application isn’t reachable from untrusted subnets in the first place. No individual signal is trusted enough on its own to grant access.

Defense in depth: layers, not a single wall

Defense in depth is a related but distinct idea. Rather than a philosophy about verification, it’s a structural approach: stack multiple, independent security controls across an environment so that if an attacker gets through one layer, the next layer is still standing in front of them. Commonly cited layers run from the outside in — physical security, identity and access, perimeter, network, compute, application, and data — with the data layer, protected through encryption and strict access control, treated as the innermost and last line of defense, since it protects the actual asset an attacker is after even after every outer layer has failed.

A useful way to see the two working together: a financial services firm designs its systems so that even if an attacker steals valid credentials — one layer defeated — a Conditional Access policy demanding a compliant device stops them at the identity layer, and network segmentation limiting lateral movement stops them again even if that fails too. Each layer is independent; no single failure cascades into full exposure. Relying on one strong perimeter firewall as the only control is the direct opposite of this approach and is a favorite wrong answer on exam questions probing the concept.

Microsoft Defender for Cloud: measuring and enforcing both

Microsoft Defender for Cloud is where these two concepts become operational in Azure. It combines two roles: cloud security posture management, which assesses resource configurations against best practices and issues prioritized recommendations, and cloud workload protection, which actively detects threats against running resources.

Secure Score is the single aggregated percentage Defender for Cloud calculates from your outstanding recommendations — enabling MFA for privileged accounts, encrypting a storage account, and similar items each count toward it. It exists to make security posture measurable at a glance and to help prioritize which fix moves the needle most, rather than working through recommendations in no particular order.

Foundational posture management and Secure Score are free. Active threat detection is not — it requires enabling specific paid Defender plans matched to the resource type, such as Defender for Servers for VM-level threats like malware and suspicious processes, or Defender for SQL for database threats. This split matters for scenario questions: a budget-constrained organization can get posture recommendations and a Secure Score at no cost today, then layer on paid Defender plans later only for the resource types that need active protection. Defender for Cloud also extends across environments — connected AWS or GCP resources and on-premises machines onboarded through Azure Arc all show up in the same unified view, which is why it’s the answer whenever a scenario asks for a single security posture view spanning multiple clouds.

A separate feature worth knowing by name: the regulatory compliance dashboard, which maps specific security controls to recognized compliance frameworks and continuously tracks alignment — the right answer whenever a scenario calls for demonstrating alignment with a regulatory standard over time, not a one-time audit.

Zero Trust vs. defense in depth vs. Defender for Cloud

	Zero Trust	Defense in depth	Microsoft Defender for Cloud
What it is	A verification philosophy	A layered-controls strategy	A security posture and threat-detection tool
Core question it answers	Should this request be trusted?	What stops an attacker who gets past one layer?	How secure are we right now, and what’s actively threatening us?
Key components	Verify explicitly, least privilege, assume breach	Physical, identity, perimeter, network, compute, application, data layers	Secure Score, posture recommendations, paid Defender plans, compliance dashboard
Cost	A design principle, not a licensed product	A design principle, not a licensed product	Posture free; active threat detection requires paid plans

How the AZ-900 exam tests this

• The philosophy-naming question. A stem asks for the guiding principle behind never trusting a request based on network location alone. The answer is Zero Trust’s “verify explicitly,” phrased with wording close to “never trust, always verify” — memorize that exact framing since distractors often restate the old perimeter model convincingly.
• The layer-identification scenario. A stem describes encrypting files at rest and tightly controlling who can read them. That’s the data layer of defense in depth specifically, not the perimeter or compute layer — the exam expects you to place the described control at the correct layer, not just recognize “layered security” generally.
• The free-vs-paid Defender for Cloud distinction. A scenario wants posture recommendations and a Secure Score at no cost, with active VM threat detection added later. The pattern is: foundational capabilities are free, resource-specific threat protection needs a paid Defender plan (Defender for Servers, Defender for SQL, and so on).
• The “assume breach” identification. When a stem describes designing monitoring and network segmentation as though an attacker might already be inside, that’s assume breach specifically — not verify explicitly (which is about evaluating requests) and not least privilege (which is about limiting granted permissions).

Quick reference

• Zero Trust’s three principles: verify explicitly, use least-privilege access, assume breach.
• Zero Trust never trusts a request based on network location alone — every request is evaluated on its own signals.
• Defense in depth stacks independent layers — physical, identity, perimeter, network, compute, application, data — so one breach doesn’t expose everything.
• The data layer, protected by encryption and access control, is the innermost and last line of defense.
• Microsoft Defender for Cloud combines posture management (Secure Score, recommendations) with active workload threat protection.
• Posture management and Secure Score are free; resource-specific threat detection needs paid Defender plans.
• Defender for Cloud extends to multicloud and on-premises resources via Azure Arc.
• The regulatory compliance dashboard maps controls to frameworks for continuous compliance tracking.

Zero Trust and defense in depth explain why controls like Azure RBAC and Conditional Access exist in the first place, and Defender for Cloud sits on top of the shared responsibility model as the tool that shows you whether your side of that split is actually being held up. Working through AZ-900 practice questions on this domain is the fastest way to get comfortable placing a described control under the right concept.