SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses a hashing algorithm to verify that a downloaded software file has not been tampered with during transmission. This practice primarily protects which security principle?
⚠ Common exam trap
Test-takers frequently confuse hashing with encryption and select 'Confidentiality' (Option A), not realizing that hashing is a one-way function that detects changes but does not hide the data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrity
Hashing algorithms, such as SHA-256, produce a fixed-size hash value that acts as a digital fingerprint of the file. By comparing the hash of the downloaded file with the hash provided by the publisher, any change to the file—even a single bit—results in a completely different hash, immediately detecting tampering. This directly protects the integrity of the data by ensuring it has not been altered during transmission.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality ensures that data is protected from unauthorized access and disclosure, focusing on secrecy. Hashing, however, does not encrypt or obscure the data itself; it merely creates a unique fingerprint of the data's content. Therefore, while hashing can detect if data has been tampered with, it does not prevent unauthorized parties from viewing or accessing the original data, which is the primary concern of confidentiality.
- ✓
Integrity
Why this is correct
Integrity guarantees that data remains accurate, complete, and authentic throughout its lifecycle, preventing unauthorized or accidental modification. When a company uses a hashing algorithm to verify a downloaded file, it generates a unique fixed-size string (hash value) from the file's content. Comparing this hash value with a known, trusted hash confirms that the file has not been tampered with or corrupted during transmission or storage, directly addressing data integrity by ensuring its unaltered state.
- ✗
Availability
Why it's wrong here
Hashing verifies data integrity by detecting unauthorised modification, not availability, which concerns uptime and access to resources. The scenario’s focus on tamper detection directly aligns with integrity, not with ensuring the file remains accessible. This option is tempting because availability is a core security principle, and one might confuse verifying file correctness with ensuring the file is reachable—a scenario where a denial-of-service attack would make availability the correct concern.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides undeniable proof of an action or event, preventing a party from falsely denying that they performed a specific action, such as sending a message or signing a contract. While hashing is a foundational component of digital signatures, which do provide non-repudiation, hashing by itself only confirms data integrity. It does not link the data to a specific sender or prove their intent, which is essential for establishing non-repudiation.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.