SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company configures its access control system so that each user can only access the data and perform actions that are strictly necessary for their job role. This configuration is a direct implementation of which security principle?
⚠ Common exam trap
Test-takers frequently confuse least privilege with separation of duties, but separation of duties focuses on splitting permissions across multiple people to prevent collusion, whereas least privilege restricts each individual to the minimum necessary access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The configuration described—granting each user only the access and actions strictly necessary for their job role—is the direct definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required permissions via Azure RBAC roles (e.g., Reader instead of Contributor) or using Azure AD Privileged Identity Management (PIM) for just-in-time access. This minimizes the attack surface by ensuring users cannot exceed their authorized scope.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple layers of security controls to protect information and systems. This approach ensures that if one security control fails or is bypassed, other controls are in place to provide continued protection, creating a robust security posture. Examples include combining firewalls, intrusion detection systems, encryption, and physical security. The question focuses on granular user access, not a multi-layered architectural approach.
When this WOULD be correct
A question asking which security principle involves implementing multiple layers of security controls (e.g., firewalls, antivirus, intrusion detection) to protect against failures in any single layer would make defense in depth the correct answer.
- ✓
Least privilege
Why this is correct
The principle of least privilege dictates that every user, program, and process should be granted only the minimum necessary permissions to perform its legitimate function. This approach significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account or system is compromised. By restricting access to only what is essential, it minimizes the risk of unauthorized actions and data breaches, aligning directly with the scenario described.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is a control mechanism designed to prevent fraud, error, or malicious acts by requiring that no single individual has complete control over a critical or sensitive process. It involves distributing tasks and associated privileges for a sensitive operation across multiple distinct individuals, making collusion necessary for abuse. The question describes individual user access permissions, not the division of critical business processes among multiple people.
When this WOULD be correct
A company requires that no single employee can approve a payment and also process the payment; these tasks must be performed by two different people. This scenario directly implements separation of duties.
- ✗
Zero Trust
Why it's wrong here
The Zero Trust security model operates on the principle of 'never trust, always verify,' meaning no user or device is inherently trusted, regardless of its location relative to the network perimeter. Every access request must be explicitly verified and authorized based on all available data points, including user identity, device health, and service requested. While Zero Trust architectures often incorporate least privilege, its core tenet is continuous authentication and authorization for all access, which is a broader security philosophy than simply assigning minimal initial permissions.
When this WOULD be correct
A question asking: 'Which security model requires that no user or device is trusted by default, even if they are inside the corporate network?' would make Zero Trust the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Least privilegeCorrect answer▾
Why this is correct
The principle of least privilege dictates that every user, program, and process should be granted only the minimum necessary permissions to perform its legitimate function. This approach significantly reduces the attack surface by limiting the potential damage an attacker can inflict if an account or system is compromised. By restricting access to only what is essential, it minimizes the risk of unauthorized actions and data breaches, aligning directly with the scenario described.
✗Defense in depthWrong answer — click to see why▾
Why this is wrong here
The question describes granting only necessary access per job role, which is the definition of least privilege. Defense in depth involves multiple layers of security controls, not user-specific access restrictions.
★ When this WOULD be the correct answer
A question asking which security principle involves implementing multiple layers of security controls (e.g., firewalls, antivirus, intrusion detection) to protect against failures in any single layer would make defense in depth the correct answer.
Why candidates choose this
Candidates may confuse defense in depth with least privilege because both are fundamental security concepts, and they might think restricting access is part of a layered defense strategy.
✗Separation of dutiesWrong answer — click to see why▾
Why this is wrong here
Separation of duties prevents fraud by requiring multiple people to complete sensitive tasks, but it does not limit individual access to only what is necessary for their job role. The question describes limiting access per user, which is least privilege.
★ When this WOULD be the correct answer
A company requires that no single employee can approve a payment and also process the payment; these tasks must be performed by two different people. This scenario directly implements separation of duties.
Why candidates choose this
Candidates may confuse separation of duties with least privilege because both involve dividing access, but separation of duties focuses on splitting responsibilities among multiple users, not minimizing individual permissions.
✗Zero TrustWrong answer — click to see why▾
Why this is wrong here
Zero Trust is a security model that assumes no implicit trust and continuously verifies every access request, but it is not specifically about granting only the minimum necessary permissions per job role; that is the principle of least privilege.
★ When this WOULD be the correct answer
A question asking: 'Which security model requires that no user or device is trusted by default, even if they are inside the corporate network?' would make Zero Trust the correct answer.
Why candidates choose this
Candidates may confuse Zero Trust with least privilege because both involve restricting access, but Zero Trust is broader and includes continuous verification, not just minimal permissions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Just-in-time access
Just-in-time access is a security method that grants users elevated permissions only for a limited time exactly when they need them, then automatically removes those permissions.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.