SC-900 Practice Question: Describe the concepts of security, compliance, and identity

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Confidentiality

  Why it's wrong here

  Confidentiality focuses on preventing unauthorized disclosure of information, ensuring that data is accessible only to individuals with appropriate permissions. While cryptographic hashing transforms data, it is a one-way function that does not encrypt or obscure the original content. The data itself remains readable by anyone who can access it; hashing merely provides a mechanism to detect if that readable data has been changed, rather than preventing its unauthorized viewing.

  When this WOULD be correct

  A company encrypts a software file before transmission to prevent unauthorized access. Which principle of the CIA triad is primarily being addressed?

• ✓

  Integrity

  Why this is correct

  Integrity ensures that data remains unaltered and complete from its origin to its destination. Cryptographic hashing achieves this by generating a unique, fixed-size digital fingerprint (hash value) of the data. Any modification, even a single bit change, to the original data will result in a completely different hash value, making it immediately apparent if the data has been tampered with during transmission or storage. Comparing the computed hash of a downloaded file with a trusted, pre-published hash confirms the file's authenticity and lack of corruption.

• ✗

  Availability

  Why it's wrong here

  Availability ensures that systems, applications, and data are accessible and operational to authorized users when needed. This security principle primarily concerns uptime, network access, and resilience against disruptions like denial-of-service attacks or hardware failures. Cryptographic hashing is a data verification technique that operates on the content of data to confirm its state, but it has no direct impact on the operational status, accessibility, or uptime of the systems hosting that data.

  When this WOULD be correct

  A company implements redundant servers and backup power to ensure that a critical application remains accessible during a power outage. Which principle of the CIA triad is primarily being addressed?

• ✗

  Non-repudiation

  Why it's wrong here

  Non-repudiation provides irrefutable proof that a specific action or transaction occurred, preventing a party from denying their involvement. While hashing is a critical component of non-repudiation, particularly within digital signatures, it does not provide non-repudiation on its own. Hashing only verifies the integrity of the data; it does not link the data definitively to a specific sender or prove their intent, as anyone can compute a hash of a given file. Digital signatures, which combine hashing with asymmetric encryption using a private key, are necessary to establish proof of origin and action.

  When this WOULD be correct

  A question that asks: 'Which principle ensures that a sender cannot deny having sent a digitally signed email?' would have non-repudiation as the correct answer, as digital signatures provide proof of origin.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question