Question

A financial services company is designing a new customer-facing web application on Azure. The security architect wants the design to follow the Microsoft Well-Architected Framework Security pillar principle of defense in depth so that the compromise of a single control does not lead to full breach. The architect proposes placing all security investment into a single, highly-tuned web application firewall (WAF) at the perimeter, arguing that a strong edge is sufficient. During the Well-Architected review, this proposal is flagged as misaligned with the Security pillar. Which recommendation best corrects the design while adhering to the defense-in-depth principle?

Accepted Answer

Layer independent controls across identity, network, application, and data tiers—such as Conditional Access, network segmentation, WAF, managed identities, and encryption at rest—so that each layer provides overlapping protection.

Answer

Replace the perimeter WAF with Azure DDoS Protection Standard, since volumetric protection is the highest-priority control for internet-facing applications.

Answer

Move all application components into a single tightly locked-down subnet with no inbound rules, eliminating the need for additional identity or data controls.

Answer

Invest exclusively in a Security Information and Event Management (SIEM) solution to detect breaches quickly, since prevention controls provide diminishing returns.