SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company operates an e-commerce website that must remain accessible during high-traffic holiday seasons. The IT team deploys additional web servers and implements automatic failover to a secondary data center if the primary site goes down. Which security principle is the company primarily addressing?
⚠ Common exam trap
Many exam-takers confuse availability with authorization, mistakenly thinking that controlling who can access the site (authorization) is the same as ensuring the site is up and running (availability).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Availability
The company is ensuring that the e-commerce website remains operational even during high-traffic periods or after a primary site failure. Deploying additional web servers and implementing automatic failover to a secondary data center directly supports the availability principle, which ensures that systems and data are accessible when needed. This is a core tenet of the CIA triad, and in this scenario, the focus is on uptime and resilience, not on protecting data from unauthorized access or modification.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality is the principle of preventing unauthorized disclosure of information, ensuring that data is only accessible to those with explicit permission. This is critical for protecting sensitive customer data like payment information or personal details. However, the problem statement specifically highlights the need for the e-commerce website to "remain" operational and accessible, focusing on service availability rather than the secrecy or privacy of data.
When this WOULD be correct
Confidentiality would be the correct answer in a scenario where the company implements encryption for customer payment data, access controls to prevent unauthorized viewing of sensitive information, or data masking to protect personal identifiable information (PII) during processing.
- ✗
Integrity
Why it's wrong here
Integrity, another component of the CIA triad, focuses on maintaining the accuracy, consistency, and trustworthiness of data throughout its lifecycle, preventing unauthorized modification or corruption. While vital for transactional data in an e-commerce system, the question's emphasis on keeping the website operational through redundancy and failover mechanisms does not primarily concern data alteration. The scenario prioritizes continuous service delivery over data immutability as its central challenge.
When this WOULD be correct
A scenario where the question asks about ensuring that data has not been altered during transmission or storage, such as using checksums or digital signatures to detect tampering, would make integrity the correct answer.
- ✓
Availability
Why this is correct
Availability, a core tenet of the CIA triad, directly addresses the requirement for an e-commerce website to remain operational and accessible to users without interruption. Implementing measures like additional servers for load balancing and failover mechanisms ensures system resilience, guaranteeing that services and data are continuously available even in the event of component failures or increased demand. This directly prevents service outages, which are critical for business continuity in an online retail environment.
- ✗
Authorization
Why it's wrong here
Authorization is the process of granting or denying specific permissions to authenticated users or systems, defining what actions they can perform or which resources they can access. While crucial for controlling access to sensitive data and system functions, it does not directly address the fundamental requirement for the e-commerce website to remain operational and accessible to all users. The scenario's focus on uptime and redundancy, rather than user permissions, makes authorization an incorrect fit.
When this WOULD be correct
A question describing a scenario where a company implements role-based access control (RBAC) to ensure only authorized personnel can modify critical database records would make Authorization the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AvailabilityCorrect answer▾
Why this is correct
Availability, a core tenet of the CIA triad, directly addresses the requirement for an e-commerce website to remain operational and accessible to users without interruption. Implementing measures like additional servers for load balancing and failover mechanisms ensures system resilience, guaranteeing that services and data are continuously available even in the event of component failures or increased demand. This directly prevents service outages, which are critical for business continuity in an online retail environment.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
The question focuses on maintaining website accessibility during high traffic and failover to a secondary data center, which directly relates to ensuring system uptime and resource availability, not protecting data from unauthorized access (confidentiality).
★ When this WOULD be the correct answer
Confidentiality would be the correct answer in a scenario where the company implements encryption for customer payment data, access controls to prevent unauthorized viewing of sensitive information, or data masking to protect personal identifiable information (PII) during processing.
Why candidates choose this
Candidates may confuse security principles, thinking that deploying additional servers and failover mechanisms also protect data from unauthorized access, or they may assume any security measure addresses confidentiality without analyzing the specific goal of the question.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
The question focuses on maintaining website accessibility during high traffic and failover, which directly relates to uptime and reliability (availability), not data accuracy or protection from unauthorized modification (integrity).
★ When this WOULD be the correct answer
A scenario where the question asks about ensuring that data has not been altered during transmission or storage, such as using checksums or digital signatures to detect tampering, would make integrity the correct answer.
Why candidates choose this
Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that maintaining service during failover involves ensuring data consistency, but the primary concern here is uptime, not data correctness.
✗AuthorizationWrong answer — click to see why▾
Why this is wrong here
Authorization controls who can access resources, but the question focuses on maintaining uptime and failover, which is about ensuring the system is available when needed, not about access control.
★ When this WOULD be the correct answer
A question describing a scenario where a company implements role-based access control (RBAC) to ensure only authorized personnel can modify critical database records would make Authorization the correct answer.
Why candidates choose this
Candidates may confuse authorization with availability because both involve security controls, but authorization is about permissions, not system resilience or uptime.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.