SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company configures its identity and access management system so that employees are granted only the permissions necessary to perform their job functions. For example, a sales representative has read-only access to the customer database and cannot modify financial records. Which security principle is being applied in this scenario?
⚠ Common exam trap
Many exam-takers confuse least privilege with Zero Trust, but Zero Trust is a broader architectural model that includes least privilege as one component, not the specific principle being described in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The scenario describes granting employees only the permissions necessary to perform their job functions, which is the core definition of the least privilege principle. In Microsoft identity and access management, this is implemented by assigning the minimum required Azure RBAC roles or Microsoft Entra ID directory roles, ensuring users have no more access than needed. This directly reduces the attack surface and limits potential damage from compromised accounts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Segregation of duties
Why it's wrong here
Segregation of duties is a control principle designed to prevent a single individual from having excessive power or the ability to commit and conceal errors or fraud. It mandates that critical tasks or processes be divided among multiple individuals, ensuring no single person can complete a sensitive operation end-to-end. The scenario, however, focuses on defining the specific access rights for an individual user's role, not on splitting a multi-step process across different people.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple, independent layers of security controls to protect assets. This approach aims to create redundancy, so if one security control fails, another is in place to prevent or detect an attack, encompassing elements like firewalls, intrusion detection systems, and encryption. The scenario describes a specific access control principle applied to identity, rather than a layered architecture of diverse security technologies.
- ✓
Least privilege
Why this is correct
The principle of least privilege dictates that users, applications, or systems should be granted only the minimum necessary permissions required to perform their legitimate job functions or tasks. This minimizes the potential damage from a compromised account or an insider threat by restricting access to only essential resources and operations. Granting a sales representative read-only access to customer data exemplifies this, as it provides necessary visibility without allowing unauthorized modification or deletion.
- ✗
Zero Trust
Why it's wrong here
Zero Trust is a security model that never trusts any request by default, regardless of origin. While least privilege is a component of Zero Trust, the scenario does not include other Zero Trust elements like continuous verification.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.