SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company's IT department implements a policy for server administrators: they must submit an access request to perform privileged tasks on critical servers. Each request is approved by a manager, and the granted elevated permissions automatically expire after four hours. This approach reduces the risk of standing privileges being exploited. Which security concept is primarily being applied?
⚠ Common exam trap
Test-takers frequently confuse 'least privilege' (a static principle of minimal permissions) with 'just-in-time access' (a dynamic, time-bound activation mechanism), but the question's emphasis on 'request, approval, and automatic expiration' specifically points to JIT, not just the principle of least privilege.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Just-in-time access
Just-in-time (JIT) access is a security concept that grants elevated permissions only when needed, for a limited duration, and requires approval. In this scenario, the policy requires an access request, manager approval, and automatic expiration after four hours, which directly aligns with JIT access to reduce the risk of standing privileges being exploited.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Just-in-time access
Why this is correct
Just-in-time (JIT) access grants temporary, time-limited elevated permissions to users or systems only when explicitly requested and strictly for the duration required to complete a specific task. This approach minimizes the window of opportunity for misuse or compromise by ensuring that administrative privileges are not persistently held. The scenario directly describes this mechanism of on-demand, temporary access for server administration.
- ✗
Least privilege
Why it's wrong here
Least privilege is a fundamental security principle dictating that users and processes should be granted only the minimum necessary permissions to perform their authorized tasks, and no more, on a permanent basis. While just-in-time access strongly supports this principle by limiting the duration of elevated rights, least privilege itself refers to the *permanent* baseline access level, not the temporary elevation mechanism described in the scenario.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a security strategy that employs multiple, overlapping layers of security controls to protect assets, so that if one control fails, another is in place to provide protection. This comprehensive approach involves diverse security measures like firewalls, intrusion detection systems, and encryption across different domains. The scenario, however, describes a single, specific access control technique rather than a comprehensive, multi-layered security architecture.
- ✗
Zero Trust
Why it's wrong here
Zero Trust is a comprehensive security model founded on the principle of 'never trust, always verify,' requiring strict identity verification for every user and device attempting to access resources, regardless of their location. It involves continuous authentication, authorization, and micro-segmentation across the entire environment. While just-in-time access is a critical component that supports a Zero Trust architecture by enforcing granular, temporary access, the scenario specifically illustrates the JIT mechanism itself, not the entire overarching Zero Trust framework.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.