SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company hosts a mission-critical customer portal on Azure virtual machines. To ensure continuous availability, they deploy the application across two separate Azure regions. If one region experiences a failure, traffic is automatically routed to the other region with minimal disruption. Which security goal is primarily being addressed by this architecture?
⚠ Common exam trap
Watch out — candidates often confuse high availability (availability goal) with disaster recovery or think that multi-region deployment primarily protects data confidentiality or integrity, when in fact it is designed to ensure continuous service uptime.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Availability
Deploying a mission-critical application across two Azure regions with automatic traffic routing directly addresses the security goal of availability. This architecture ensures that if one region fails, the application remains accessible from the other region, minimizing downtime. Azure Traffic Manager or Azure Front Door can be used to route traffic based on priority or latency, providing high availability and disaster recovery.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality focuses on protecting information from unauthorized disclosure, ensuring that only authorized individuals or systems can access sensitive data. While data might be replicated across regions for availability, this redundancy mechanism does not inherently implement controls like encryption, access policies, or data masking that are crucial for preventing unauthorized viewing or theft of the data. Multi-region deployment primarily addresses service uptime, not the secrecy of the information itself.
When this WOULD be correct
A question describing encryption of customer data at rest and in transit, or implementing access controls to prevent unauthorized disclosure, would make confidentiality the correct answer.
- ✗
Integrity
Why it's wrong here
Integrity ensures that data remains accurate, complete, and unaltered throughout its lifecycle, protecting it from unauthorized or accidental modification. While multi-region replication can help maintain data consistency across distributed systems, its primary purpose is service continuity, not the prevention of data tampering. Mechanisms like hashing, digital signatures, version control, and strict access controls are the direct methods used to safeguard data integrity against unauthorized alterations.
When this WOULD be correct
Integrity would be correct if the question described a scenario where the company uses Azure SQL Database with transparent data encryption (TDE) or Azure Storage with immutable blobs to prevent unauthorized modification of customer data.
- ✓
Availability
Why this is correct
Deploying a mission-critical customer portal across multiple Azure regions with automatic failover directly addresses the 'A' in the CIA triad: Availability. This strategy ensures that the portal remains continuously accessible and operational for authorized users, even if an entire geographic region experiences a catastrophic outage. The primary objective is to minimize downtime and provide uninterrupted service, which is paramount for mission-critical systems.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation is the assurance that a party cannot successfully deny the validity of a statement or action they have made. This security principle is typically achieved through robust audit logging, digital signatures, and strong identity management systems that definitively link an action to a specific user or entity. Geographic redundancy, while enhancing service resilience, does not provide the cryptographic or evidentiary proof required to prevent a user from disclaiming their past actions or transactions.
When this WOULD be correct
An exam question might ask: 'A company needs to ensure that customers cannot deny having placed orders on an e-commerce site. Which security goal is primarily addressed by implementing digital signatures on order confirmations?' In that context, non-repudiation would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AvailabilityCorrect answer▾
Why this is correct
Deploying a mission-critical customer portal across multiple Azure regions with automatic failover directly addresses the 'A' in the CIA triad: Availability. This strategy ensures that the portal remains continuously accessible and operational for authorized users, even if an entire geographic region experiences a catastrophic outage. The primary objective is to minimize downtime and provide uninterrupted service, which is paramount for mission-critical systems.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
Confidentiality ensures data is accessible only to authorized users, but the described architecture focuses on maintaining service uptime across regions, which is a core availability concern.
★ When this WOULD be the correct answer
A question describing encryption of customer data at rest and in transit, or implementing access controls to prevent unauthorized disclosure, would make confidentiality the correct answer.
Why candidates choose this
Candidates may confuse high-availability architectures with security measures, mistakenly thinking that ensuring continuous access also protects data secrecy.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
Integrity ensures data is not tampered with, but the scenario describes deploying across regions for automatic failover, which directly addresses availability, not integrity.
★ When this WOULD be the correct answer
Integrity would be correct if the question described a scenario where the company uses Azure SQL Database with transparent data encryption (TDE) or Azure Storage with immutable blobs to prevent unauthorized modification of customer data.
Why candidates choose this
Candidates may confuse high availability with data protection, thinking that replicating data across regions also ensures its integrity, but integrity is about preventing unauthorized changes, not uptime.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that actions or transactions cannot be denied by the parties involved, typically through digital signatures or audit logs. The scenario describes a multi-region deployment for failover, which directly addresses availability, not non-repudiation.
★ When this WOULD be the correct answer
An exam question might ask: 'A company needs to ensure that customers cannot deny having placed orders on an e-commerce site. Which security goal is primarily addressed by implementing digital signatures on order confirmations?' In that context, non-repudiation would be the correct answer.
Why candidates choose this
Candidates may confuse non-repudiation with high availability or disaster recovery, thinking that ensuring service continuity also prevents denial of actions, but non-repudiation is about accountability and proof, not uptime.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.