A strategy that protects data with several layers of security: physical, identity and access, perimeter, network, compute, application, and data. If one layer fails, the next ones keep protecting and slow the attacker down.
In SC-900 it appears alongside the CIA triad (confidentiality, integrity, and availability). The key idea is not to rely on a single control, such as a perimeter firewall.
Defense in depth is a concept that can show up on the exam. Check the full guide to see it in context.