SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company requires all employees to provide a one-time passcode generated by an authenticator app in addition to their password when accessing the corporate VPN. This practice is an example of which security concept?
⚠ Common exam trap
Many candidates confuse authentication (proving identity) with authorization (granting permissions), especially when the question describes a 'gate' like VPN access, leading them to incorrectly select authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
C. Authentication
The requirement for a one-time passcode (OTP) from an authenticator app in addition to a password is a classic implementation of multi-factor authentication (MFA). Authentication is the process of verifying the identity of a user, device, or service, and this scenario uses two distinct factors: something you know (password) and something you have (the OTP generated by the app). This directly aligns with the security concept of authentication, not authorization, auditing, or accounting.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A. Authorization
Why it's wrong here
Authorization determines the specific permissions and access rights an authenticated user or system possesses to various resources or functions. It answers the question of *what* a verified identity is allowed to do, such as reading a file or modifying a database record, based on predefined policies or roles. This process occurs *after* successful authentication, granting or denying access based on the user's established identity.
When this WOULD be correct
A question that asks: 'After a user authenticates, the system checks if they have permission to access a specific file. This is an example of which security concept?' — then authorization would be correct.
- ✗
B. Auditing
Why it's wrong here
Auditing involves the systematic review and analysis of security logs and records, often generated through accounting processes, to ensure compliance, detect anomalies, or investigate security incidents. It is a retrospective activity focused on examining past events and user actions to identify policy violations or suspicious behavior. Auditing provides accountability and insights into security posture, distinct from the real-time act of proving identity.
When this WOULD be correct
A company requires all VPN access attempts to be logged and reviewed monthly for unauthorized access attempts. This practice is an example of auditing.
- ✓
C. Authentication
Why this is correct
Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.
- ✗
D. Accounting
Why it's wrong here
Accounting, within the AAA framework, is the process of tracking and logging user activities and resource consumption after successful authentication and authorization. It records *what* an authenticated user does, such as files accessed or changes made, providing an audit trail for compliance, billing, or forensic analysis. This differs from identity verification, as it focuses on usage monitoring rather than proving who the user is.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓C. AuthenticationCorrect answer▾
Why this is correct
Authentication is the foundational security process of verifying an entity's identity, confirming they are who they claim to be. In this scenario, requiring a one-time passcode (OTP) alongside another factor, like a password, establishes multi-factor authentication (MFA). This robust method significantly enhances security by requiring multiple proofs of identity before granting access to a system or resource, directly addressing the company's need to confirm employee identity.
✗A. AuthorizationWrong answer — click to see why▾
Why this is wrong here
Authorization determines what resources a user can access after authentication, but the scenario describes verifying identity via a one-time passcode, which is an authentication process, not authorization.
★ When this WOULD be the correct answer
A question that asks: 'After a user authenticates, the system checks if they have permission to access a specific file. This is an example of which security concept?' — then authorization would be correct.
Why candidates choose this
Candidates may confuse the terms 'authentication' and 'authorization' because both involve access control, and the use of a passcode might be mistakenly thought to grant access rights rather than verify identity.
✗B. AuditingWrong answer — click to see why▾
Why this is wrong here
Auditing refers to the process of reviewing and analyzing logs or records to ensure compliance or detect anomalies, not to verifying identity. The question describes verifying identity via password and passcode, which is authentication, not auditing.
★ When this WOULD be the correct answer
A company requires all VPN access attempts to be logged and reviewed monthly for unauthorized access attempts. This practice is an example of auditing.
Why candidates choose this
Candidates may confuse auditing with authentication because both involve security controls, and auditing often includes reviewing authentication logs, leading them to think the passcode step is part of an audit process.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
MFA
Multi-Factor Authentication (MFA) is a security method that requires a user to verify their identity using two or more different types of evidence, such as a password plus a code from a phone, before they can access an account or system.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.