SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Integrity

  Why it's wrong here

  Integrity, in information security, is concerned with maintaining the accuracy, consistency, and trustworthiness of data throughout its entire lifecycle. Its primary objective is to prevent unauthorized modification, alteration, or destruction of information, ensuring that data remains complete and uncorrupted. While robust access controls contribute to integrity by preventing unauthorized changes, its focus is on the state and reliability of the data itself, not on restricting initial viewing access to authorized users.

  When this WOULD be correct

  A question that asks: 'A company wants to ensure that customer data has not been altered during transmission. Which security principle does this enforce?' In that context, integrity would be correct because it focuses on protecting data from unauthorized modification.

• ✗

  Availability

  Why it's wrong here

  Availability, within the context of information security, ensures that authorized users can access systems and data when needed, without undue delay or interruption. While crucial for business operations, its primary focus is on the uptime, resilience, and responsiveness of resources, rather than the specific control mechanisms that limit access exclusively to authorized individuals. Therefore, it addresses the presence and usability of data, not the restriction of its disclosure to unauthorized parties.

• ✓

  Confidentiality

  Why this is correct

  Confidentiality is the fundamental security principle that ensures information is not disclosed to unauthorized individuals, entities, or processes. It directly addresses the requirement of limiting access to customer data only to those who are explicitly authorized, typically through mechanisms like encryption, access control lists (ACLs), and the principle of least privilege. This principle is paramount for protecting sensitive information from unauthorized viewing or exposure, aligning perfectly with the stated security policy.

• ✗

  Non-repudiation

  Why it's wrong here

  Non-repudiation provides irrefutable proof that a specific action or event has occurred, preventing any party from denying their involvement or the authenticity of a transaction. This is often achieved through digital signatures, audit trails, and cryptographic techniques, establishing accountability for actions such as sending a message or making a purchase. However, non-repudiation does not govern or enforce who is authorized to initially access or view data; it merely confirms that an action, once performed, cannot be legitimately denied.

  When this WOULD be correct

  A question where the security policy requires that sales representatives cannot deny having accessed or modified customer data, such as 'The company needs to prove that a sales representative viewed a customer record; which principle is enforced?'

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question