SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company implements regular data backups and a disaster recovery plan to restore critical systems after an outage. Which security principle is primarily being addressed by these measures?
⚠ Common exam trap
Test-takers frequently confuse backups and disaster recovery with Confidentiality or Integrity, mistakenly thinking that protecting data copies implies preventing unauthorized access or tampering, rather than recognizing that the core goal is restoring access and system operation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Availability
Regular data backups and a disaster recovery plan directly ensure that critical systems and data can be restored and remain accessible after an outage. This aligns with the Availability principle of the CIA triad, which guarantees that authorized users have reliable access to resources when needed. In Azure, this is supported by services like Azure Backup and Azure Site Recovery, which provide automated backup and failover capabilities to maintain uptime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality focuses on preventing unauthorized disclosure of information, ensuring that only authorized individuals or systems can access sensitive data. While backups can be encrypted to protect confidentiality of data at rest, the primary purpose of implementing regular data backups and disaster recovery is not to restrict access, but rather to ensure the continued existence and accessibility of data after an adverse event, which is availability.
When this WOULD be correct
A question that asks which security principle is addressed by encrypting data at rest and in transit, or by implementing access controls to prevent unauthorized disclosure, would have confidentiality as the correct answer.
- ✗
Integrity
Why it's wrong here
Data integrity guarantees that information remains accurate, complete, and unaltered throughout its lifecycle, preventing unauthorized or accidental modification. While restoring from a backup can indeed restore data to a known good state, thereby addressing integrity issues caused by corruption or accidental deletion, the fundamental objective of creating backups and having a disaster recovery plan is to ensure the presence and accessibility of data, not primarily its accuracy or immutability.
When this WOULD be correct
A question asking which security principle is addressed by hashing or digital signatures to verify data has not been altered during transmission would make integrity the correct answer.
- ✓
Availability
Why this is correct
Regular data backups and a disaster recovery plan are fundamental controls to ensure Availability. Availability guarantees that authorized users can access information and systems when needed, without undue interruption. By creating redundant copies of data and establishing procedures to restore operations after disruptive events, these measures directly support the continuous accessibility and usability of critical business resources.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides irrefutable proof that a specific action or event has occurred, preventing an individual or entity from denying their involvement. This is typically achieved through mechanisms like digital signatures, audit trails, or cryptographic hashes linked to specific actions. Regular data backups and disaster recovery plans are designed for data restoration and business continuity, not for establishing undeniable proof of past actions or transactions.
When this WOULD be correct
A question that asks: 'A company uses digital signatures to ensure that employees cannot deny having submitted expense reports. Which security principle is being addressed?' In that context, non-repudiation would be the correct answer because digital signatures provide proof of origin and integrity, preventing denial of actions.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AvailabilityCorrect answer▾
Why this is correct
Regular data backups and a disaster recovery plan are fundamental controls to ensure Availability. Availability guarantees that authorized users can access information and systems when needed, without undue interruption. By creating redundant copies of data and establishing procedures to restore operations after disruptive events, these measures directly support the continuous accessibility and usability of critical business resources.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
Data backups and disaster recovery plans primarily ensure that systems and data can be restored after an outage, which directly supports availability. Confidentiality is about preventing unauthorized access, not about restoring systems after failures.
★ When this WOULD be the correct answer
A question that asks which security principle is addressed by encrypting data at rest and in transit, or by implementing access controls to prevent unauthorized disclosure, would have confidentiality as the correct answer.
Why candidates choose this
Candidates may confuse backups with protecting data from unauthorized access, thinking backups prevent data breaches, but backups are about recovery, not confidentiality.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
Integrity ensures data is not tampered with or altered, but backups and disaster recovery primarily restore availability after an outage, not protect against unauthorized modifications.
★ When this WOULD be the correct answer
A question asking which security principle is addressed by hashing or digital signatures to verify data has not been altered during transmission would make integrity the correct answer.
Why candidates choose this
Candidates may confuse backups with ensuring data remains unchanged (integrity), not realizing backups primarily restore access (availability).
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that actions or transactions cannot be denied by the parties involved, typically through digital signatures or audit logs. Data backups and disaster recovery do not address non-repudiation; they focus on restoring system functionality after an outage, which is about availability.
★ When this WOULD be the correct answer
A question that asks: 'A company uses digital signatures to ensure that employees cannot deny having submitted expense reports. Which security principle is being addressed?' In that context, non-repudiation would be the correct answer because digital signatures provide proof of origin and integrity, preventing denial of actions.
Why candidates choose this
Candidates may confuse non-repudiation with availability because both involve ensuring that systems and data are accessible when needed, but non-repudiation specifically deals with accountability and proof of actions, not system uptime or recovery.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Confidentiality Integrity and Availability
The CIA Triad is a foundational security model that ensures data is kept secret, unaltered, and accessible when needed.
Key term
Business Continuity Planning
Business Continuity Planning is the process of creating a strategy to keep an organization's essential functions running during and after a major disruption.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.