SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company's security team implements a system where every access attempt to sensitive data is recorded, including who accessed the data and when. The logs are regularly reviewed to detect unauthorized access and to hold users accountable for their actions. Which security goal is primarily being addressed by this logging practice?
⚠ Common exam trap
Watch out — candidates often confuse logging with confidentiality or integrity, thinking that recording access prevents unauthorized viewing or data modification, when in fact logging is about accountability and non-repudiation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Non-repudiation
Non-repudiation ensures that a user cannot deny having performed an action. By recording who accessed sensitive data and when, the logging practice creates an audit trail that can prove a specific user accessed the data at a specific time, thereby preventing the user from denying that access. This directly addresses the security goal of non-repudiation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality aims to protect information from unauthorized disclosure, ensuring that only authorized individuals or systems can access sensitive data. While logging access attempts can help detect breaches and inform post-incident analysis, the act of recording who accessed what does not inherently prevent the initial unauthorized access or disclosure from occurring. Its primary function is not to enforce secrecy but to document interactions.
- ✗
Integrity
Why it's wrong here
Integrity ensures that data remains accurate, complete, and authentic throughout its lifecycle, preventing unauthorized modification or destruction. While audit logs can record who modified data and when, the mere act of logging access (reads) does not directly prevent unauthorized alterations to the data itself. Its focus is on documenting interactions, not on guaranteeing the immutability or correctness of the data's content.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can reliably access systems and data when needed, guaranteeing continuous operation and responsiveness. Implementing a system to log every access primarily focuses on recording events, not on maintaining system uptime, ensuring data accessibility, or preventing service disruptions. Logging does not inherently provide redundancy, fault tolerance, or performance optimizations crucial for availability.
- ✓
Non-repudiation
Why this is correct
Non-repudiation provides irrefutable proof that a specific action or event occurred and identifies the entity responsible, preventing them from falsely denying their involvement. By implementing a system that logs every access, an immutable audit trail is created, documenting who accessed what, when, and from where. This comprehensive record serves as forensic evidence, holding users accountable for their actions and making it impossible for them to credibly deny having performed a particular operation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.