SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company deploys firewalls, intrusion detection systems, and endpoint antivirus software at multiple layers of its network. This strategy is intended to ensure that if one security control fails, others still provide protection. Which security concept does this approach represent?
⚠ Common exam trap
It's easy for candidates to confuse 'defense in depth' with 'zero trust' because both involve multiple security controls, but zero trust is specifically about eliminating implicit trust through continuous verification, not about layering independent defenses.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth
Defense in depth is a security strategy that layers multiple independent controls—such as firewalls, intrusion detection systems (IDS), and endpoint antivirus—across different network segments. The core principle is that if one layer is breached or fails, subsequent layers continue to provide protection, ensuring no single point of failure compromises the entire security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Defense in depth
Why this is correct
Defense in depth is a cybersecurity strategy that employs multiple, overlapping security controls to protect information and systems. This layered approach ensures that if one security mechanism fails or is bypassed, other controls are in place to prevent or detect unauthorized access. The deployment of firewalls and intrusion detection systems, as described, exemplifies this strategy by creating successive barriers against threats.
- ✗
Least privilege
Why it's wrong here
The principle of least privilege dictates that users, processes, and applications should be granted only the minimum necessary permissions or access rights required to perform their legitimate functions. This minimizes the potential damage from accidental misuse or malicious exploitation of an account. While a critical security principle, it does not describe the deployment of multiple, distinct security technologies like firewalls and IDS to form layered defenses.
When this WOULD be correct
A question that asks: 'A company configures user accounts so that employees can only access files necessary for their job roles. Which security concept does this represent?' — here, least privilege is the correct answer.
- ✗
Separation of duties
Why it's wrong here
Separation of duties is an internal control principle designed to prevent fraud, error, and abuse by ensuring that no single individual has complete control over a critical process or transaction. It involves dividing responsibilities for key tasks among multiple individuals, requiring collusion to compromise a system. This concept focuses on administrative and procedural controls over human actions, rather than the technical layering of security technologies like firewalls and IDS.
When this WOULD be correct
A question that asks: 'A company requires that no single employee can approve a purchase order and also receive the goods. This policy reduces the risk of fraud. Which security concept does this represent?' In that scenario, separation of duties would be the correct answer.
- ✗
Zero trust
Why it's wrong here
Zero trust is a security model that requires continuous verification of every access request, treating all users as potential threats even if inside the network. It is not the same as deploying multiple security layers.
When this WOULD be correct
A question that asks: 'A company implements a security model where no user or device is trusted by default, and every access request is authenticated and authorized regardless of location.'
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Defense in depthCorrect answer▾
Why this is correct
Defense in depth is a cybersecurity strategy that employs multiple, overlapping security controls to protect information and systems. This layered approach ensures that if one security mechanism fails or is bypassed, other controls are in place to prevent or detect unauthorized access. The deployment of firewalls and intrusion detection systems, as described, exemplifies this strategy by creating successive barriers against threats.
✗Least privilegeWrong answer — click to see why▾
Why this is wrong here
The question describes multiple layers of security controls (firewalls, IDS, antivirus) to ensure protection if one fails, which is the definition of defense in depth, not least privilege.
★ When this WOULD be the correct answer
A question that asks: 'A company configures user accounts so that employees can only access files necessary for their job roles. Which security concept does this represent?' — here, least privilege is the correct answer.
Why candidates choose this
Candidates may confuse the principle of limiting access (least privilege) with the layered approach of defense in depth, or they might think that implementing multiple controls inherently restricts privileges.
✗Separation of dutiesWrong answer — click to see why▾
Why this is wrong here
Separation of duties is about dividing responsibilities among different people to prevent fraud or error, not about layering security controls to provide redundancy. The question describes multiple security layers, which is defense in depth, not separation of duties.
★ When this WOULD be the correct answer
A question that asks: 'A company requires that no single employee can approve a purchase order and also receive the goods. This policy reduces the risk of fraud. Which security concept does this represent?' In that scenario, separation of duties would be the correct answer.
Why candidates choose this
Candidates may confuse 'separation of duties' with 'defense in depth' because both involve multiple controls, but separation of duties focuses on task division among people, not layered technical defenses.
✗Zero trustWrong answer — click to see why▾
Why this is wrong here
Zero trust is a security model that assumes no implicit trust and requires continuous verification of every access request, not the layered deployment of security controls described in the question.
★ When this WOULD be the correct answer
A question that asks: 'A company implements a security model where no user or device is trusted by default, and every access request is authenticated and authorized regardless of location.'
Why candidates choose this
Candidates may confuse the layered approach of defense in depth with the 'never trust, always verify' principle of zero trust, as both involve multiple security measures.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security posture
An organization's overall cybersecurity strength, including policies, controls, and readiness to defend against and respond to threats.
Key term
Security control
A security control is a safeguard or countermeasure designed to protect the confidentiality, integrity, and availability of information systems and data.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.