SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company uses digital signatures to ensure that a sender cannot later deny having sent a message. Which security principle does this primarily address?
⚠ Common exam trap
Candidates often confuse digital signatures with encryption, assuming they primarily provide confidentiality, when in fact signatures focus on authentication and non-repudiation, while encryption (e.g., using the recipient's public key) is what ensures confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Non-repudiation
Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to bind a signer's identity to a message. The signature is created with the sender's private key and verified with their public key, providing cryptographic proof of origin. This directly enforces non-repudiation because the sender cannot plausibly deny having signed the message, as only they possess the private key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality, which ensures that information is accessible only to authorized individuals, is primarily achieved through encryption. Digital signatures, conversely, do not encrypt or obscure the message content itself. Their function is to prove the sender's identity and the message's integrity, meaning the content remains readable by anyone who intercepts it unless separate encryption is applied.
When this WOULD be correct
Confidentiality would be correct in a question like: 'Which security principle is primarily addressed by encrypting the contents of an email so that only the intended recipient can read it?'
- ✗
Integrity
Why it's wrong here
While digital signatures indeed provide integrity by ensuring that any alteration to the message after signing would invalidate the signature, this option is not the most precise answer for preventing a sender from denying an action. Integrity focuses on detecting tampering with the message content. The question specifically asks about preventing the sender from denying sending the message, which is the core definition of non-repudiation.
When this WOULD be correct
Integrity would be correct if the question asked: 'Which security principle ensures that a message has not been altered during transmission?' or 'Which principle is primarily addressed by hashing algorithms?'
- ✗
Availability
Why it's wrong here
Availability refers to the assurance that systems and data are accessible and usable by authorized users when needed. Digital signatures play no direct role in maintaining system uptime, network connectivity, or resource accessibility. Their cryptographic function is focused on identity verification and data integrity, not on the operational state or accessibility of services.
When this WOULD be correct
A question asking which security principle is primarily addressed by ensuring that a system remains operational and accessible during a denial-of-service attack would have availability as the correct answer.
- ✓
Non-repudiation
Why this is correct
Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Non-repudiationCorrect answer▾
Why this is correct
Digital signatures achieve non-repudiation by cryptographically binding a sender's identity to a message. The sender uses their unique private key to sign a hash of the document, creating a verifiable digital fingerprint. This signature, which can be validated by anyone with the sender's corresponding public key, provides irrefutable proof of origin and consent, ensuring the sender cannot legitimately deny having sent the message or performed the action.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
Digital signatures prevent a sender from denying having sent a message, which is non-repudiation, not confidentiality. Confidentiality ensures that data is not disclosed to unauthorized parties, which is not the primary concern here.
★ When this WOULD be the correct answer
Confidentiality would be correct in a question like: 'Which security principle is primarily addressed by encrypting the contents of an email so that only the intended recipient can read it?'
Why candidates choose this
Candidates may confuse digital signatures with encryption, thinking that signing a message also keeps it secret, or they may not clearly distinguish between integrity/non-repudiation and confidentiality.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
Digital signatures primarily ensure non-repudiation, not integrity. While digital signatures do provide integrity by detecting tampering, the question specifically asks about preventing the sender from denying having sent the message, which is the definition of non-repudiation.
★ When this WOULD be the correct answer
Integrity would be correct if the question asked: 'Which security principle ensures that a message has not been altered during transmission?' or 'Which principle is primarily addressed by hashing algorithms?'
Why candidates choose this
Candidates may confuse integrity with non-repudiation because digital signatures also provide integrity, and they might think that ensuring the message hasn't been altered is the same as proving the sender's identity.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures the sender cannot deny sending a message, which is not addressed by availability. Availability ensures systems and data are accessible when needed, not the undeniability of actions.
★ When this WOULD be the correct answer
A question asking which security principle is primarily addressed by ensuring that a system remains operational and accessible during a denial-of-service attack would have availability as the correct answer.
Why candidates choose this
Candidates may confuse the concept of preventing denial of action (non-repudiation) with preventing denial of service (availability), or they may think that digital signatures also ensure the message is available, but that is not their primary purpose.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Non-repudiation
Non-repudiation is a security principle that ensures a party in a digital transaction cannot deny their involvement or the authenticity of their digital signature.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.