SC-900 Authentication Practice Question
A company requires users to enter a password and then a temporary code from a mobile app to sign in. After signing in, a user attempts to open a confidential document but is denied because they are not a member of the 'Managers' group. Which two security concepts are primarily demonstrated in this scenario?
⚠ Common exam trap
Candidates often think Identification and Non-repudiation are also demonstrated, but the scenario only explicitly shows Authentication (password + mobile code) and Authorization (group-based access control). Identification is implicit but not part of the demonstration, and non-repudiation is not addressed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication and Authorization
The scenario demonstrates two security concepts: Authentication and Authorization. The user enters a password and a temporary code from a mobile app to sign in – this is multi-factor authentication (something you know and something you have), verifying the user's identity. After signing in, the attempt to open a confidential document is denied because the user is not a member of the 'Managers' group – this is authorization, controlling access based on group membership. Identification (claiming an identity) is not demonstrated because the scenario does not mention entering a username or similar identifier. Non-repudiation is not demonstrated because there is no evidence that the authentication method provides proof that cannot be denied; the temporary code is simply a second factor for authentication, not a non-repudiation mechanism.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication and Authorization
Why this is correct
Correct. The password and mobile code demonstrate authentication, and the group-based denial demonstrates authorization.
- ✗
Identification and Non-repudiation
Why it's wrong here
Incorrect. Identification (username claim) is not shown, and non-repudiation is not established by the mobile code alone.
- ✗
Encryption and Hashing
Why it's wrong here
Incorrect. Encryption and hashing are not involved in this scenario.
When this WOULD be correct
A question describing a company that stores passwords using a one-way function and encrypts sensitive files at rest, asking which security concepts are used to protect the data.
- ✗
Accounting and Auditing
Why it's wrong here
Incorrect. Accounting and auditing are not demonstrated; there is no logging or activity review.
When this WOULD be correct
A question describing a system that logs all user activities and uses those logs to investigate a security incident or ensure compliance would make 'Accounting and Auditing' correct.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Authentication and AuthorizationCorrect answer▾
Why this is correct
Correct. The password and mobile code demonstrate authentication, and the group-based denial demonstrates authorization.
✗Encryption and HashingWrong answer — click to see why▾
Why this is wrong here
Encryption and hashing are not demonstrated in this scenario. The scenario involves password and code entry (authentication) and group-based access control (authorization), not data protection through encryption or hashing.
★ When this WOULD be the correct answer
A question describing a company that stores passwords using a one-way function and encrypts sensitive files at rest, asking which security concepts are used to protect the data.
Why candidates choose this
Candidates may confuse the temporary code from a mobile app as an encrypted token, or think that password storage involves hashing, but the scenario focuses on access control, not data protection.
✗Accounting and AuditingWrong answer — click to see why▾
Why this is wrong here
The scenario describes access control (authentication and authorization) but does not involve tracking user actions or reviewing logs, which are central to accounting and auditing.
★ When this WOULD be the correct answer
A question describing a system that logs all user activities and uses those logs to investigate a security incident or ensure compliance would make 'Accounting and Auditing' correct.
Why candidates choose this
Candidates may confuse the temporary code from the mobile app as a form of auditing or accounting, or they may think that any security process inherently includes logging and review.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.