SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company implements a security strategy that includes multiple layers of controls: a perimeter firewall, an intrusion detection system, endpoint antivirus software, and multi-factor authentication for user access. The goal is that if one layer fails, another layer is in place to prevent or mitigate an attack. Which security principle does this approach best represent?
⚠ Common exam trap
Candidates often confuse 'Defense in depth' with 'Zero Trust' because both involve multiple security controls, but Zero Trust is specifically about eliminating implicit trust and verifying every access request, not about layering defenses as a fail-safe mechanism.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Defense in depth
Defense in depth is a security strategy that layers independent defensive mechanisms so that if one layer fails, another layer is already in place to prevent or mitigate an attack. The scenario explicitly describes multiple layers (firewall, IDS, endpoint antivirus, MFA) working together, which is the core definition of defense in depth. This approach ensures no single point of failure can compromise the entire security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Defense in depth
Why this is correct
Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.
- ✗
Zero Trust
Why it's wrong here
Zero Trust is a security model that focuses on verifying every request as though it originates from an untrusted network, but the scenario does not mention the core pillars of Zero Trust (verify explicitly, least privilege, assume breach). It simply lists multiple layers.
When this WOULD be correct
Zero Trust would be correct in a question describing a strategy where no user or device is trusted by default, even if inside the network, and every access request is verified, authenticated, and authorized before granting access.
- ✗
Least privilege
Why it's wrong here
The principle of least privilege dictates that users, processes, and applications should be granted only the minimum necessary permissions to perform their legitimate functions. While a critical component of a strong security posture, it is an access control concept focused on limiting authorization, not a strategy for deploying multiple, overlapping layers of diverse security controls across an entire infrastructure. Therefore, it does not directly describe a strategy that includes multiple defensive layers.
When this WOULD be correct
A question that asks: 'A company restricts user accounts to only the permissions required to perform their job functions. Which security principle does this represent?' would make least privilege the correct answer.
- ✗
CIA triad
Why it's wrong here
The CIA triad, comprising Confidentiality, Integrity, and Availability, represents the fundamental objectives that any robust security program aims to achieve for information and systems. These are security goals or principles that define what needs to be protected, rather than a specific strategy or methodology for how to implement multiple, layered security controls. It guides the design of security measures but is not itself a multi-layered defensive strategy.
When this WOULD be correct
A question asks: 'Which security principle ensures that data is not disclosed to unauthorized parties, remains accurate, and is accessible when needed?' The CIA triad would be the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Defense in depthCorrect answer▾
Why this is correct
Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets across various domains. This approach ensures that if one security control fails or is bypassed, other controls are still in place to detect, prevent, or mitigate an attack, significantly increasing resilience against diverse threat vectors. It encompasses physical, technical, and administrative safeguards, creating a robust and redundant barrier.
✗Zero TrustWrong answer — click to see why▾
Why this is wrong here
The question describes multiple layers of controls (firewall, IDS, antivirus, MFA) that work together to provide redundancy, which is the core of defense in depth. Zero Trust is a security model that assumes no implicit trust and requires continuous verification, not specifically about layered defenses.
★ When this WOULD be the correct answer
Zero Trust would be correct in a question describing a strategy where no user or device is trusted by default, even if inside the network, and every access request is verified, authenticated, and authorized before granting access.
Why candidates choose this
Candidates may confuse Zero Trust with defense in depth because both involve multiple security controls, but Zero Trust focuses on identity and access verification rather than layered physical/technical controls.
✗Least privilegeWrong answer — click to see why▾
Why this is wrong here
The question describes multiple layers of security controls, which is the essence of defense in depth, not least privilege. Least privilege focuses on granting only necessary permissions, not on layered defenses.
★ When this WOULD be the correct answer
A question that asks: 'A company restricts user accounts to only the permissions required to perform their job functions. Which security principle does this represent?' would make least privilege the correct answer.
Why candidates choose this
Candidates may confuse least privilege with defense in depth because both are fundamental security principles, but least privilege is about access control, not layered defenses.
✗CIA triadWrong answer — click to see why▾
Why this is wrong here
The CIA triad (Confidentiality, Integrity, Availability) is a model for information security policy, not a strategy for layered controls. The question describes multiple defensive layers, which is defense in depth, not the CIA triad.
★ When this WOULD be the correct answer
A question asks: 'Which security principle ensures that data is not disclosed to unauthorized parties, remains accurate, and is accessible when needed?' The CIA triad would be the correct answer.
Why candidates choose this
Candidates may confuse the CIA triad as a broad security principle and think it encompasses layered defenses, but it is actually a set of goals, not a strategy for implementing controls.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.