SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company stores sensitive customer data in an Azure SQL database. To protect this data, the database files are encrypted at rest using Transparent Data Encryption (TDE). Additionally, all network traffic between the application and the database is encrypted using TLS. Which security goal is primarily addressed by these encryption measures?
⚠ Common exam trap
Many exam-takers confuse encryption (which protects confidentiality) with integrity or non-repudiation, because encryption can indirectly help detect tampering in some contexts, but the primary security goal of TDE and TLS is to keep data secret, not to verify its origin or prevent denial of actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Transparent Data Encryption (TDE) encrypts data at rest, meaning the database files on disk are encrypted so that unauthorized access to the physical storage cannot read the data. TLS encrypts data in transit between the application and the database, preventing eavesdropping or interception over the network. Together, these measures primarily ensure that sensitive customer data remains secret and inaccessible to unauthorized parties, which is the core goal of confidentiality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Integrity
Why it's wrong here
Integrity ensures that data has not been altered or tampered with by unauthorized parties. While encryption makes data unreadable without the correct key, it does not inherently provide cryptographic proof that the data *hasn't* been modified. If encrypted data is tampered with, it will likely become undecipherable, but encryption itself doesn't offer a mechanism to detect *which* specific parts were altered or by whom. Mechanisms like hashing, Message Authentication Codes (MACs), or digital signatures are specifically designed to detect unauthorized modifications and ensure data integrity.
- ✗
Availability
Why it's wrong here
Availability refers to the assurance that authorized users can access information and systems when needed, ensuring operational uptime and accessibility. Encryption, while a critical security control, does not directly guarantee the continuous operation or accessibility of an Azure SQL Database or its underlying infrastructure. In fact, poorly managed encryption keys or significant performance overhead from encryption/decryption processes could, in some scenarios, inadvertently impact availability. Availability is primarily addressed through robust architecture, redundancy, and disaster recovery planning.
- ✓
Confidentiality
Why this is correct
Confidentiality is the principle that sensitive information is protected from unauthorized disclosure or access, ensuring that only authorized individuals or systems can read or interpret it. When a company encrypts sensitive customer data in Azure SQL, both at rest (e.g., using Transparent Data Encryption) and in transit (e.g., using TLS/SSL connections), it directly prevents unauthorized parties from understanding the data's content, even if they gain access to the raw data files or network traffic. This makes encryption a fundamental control for upholding data confidentiality.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides irrefutable proof that a specific action or event occurred, preventing an entity from denying its involvement or the origin of a message. While encryption protects the secrecy of data, it does not inherently provide proof of origin or prevent a sender from denying they sent a message, or a user from denying they performed an action. Digital signatures, which combine cryptographic hashing with asymmetric encryption using a private key, are the primary cryptographic mechanism for achieving non-repudiation by cryptographically linking an action to a specific, verifiable identity.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
SQL
SQL is a standard programming language used to manage, query, and manipulate relational databases by issuing commands like SELECT, INSERT, UPDATE, and DELETE.
Key term
SQL
SQL is a standardized programming language used to manage and manipulate relational databases, enabling querying, updating, and data retrieval.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.