SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company wants to ensure that only users with appropriate permissions can access sensitive data stored in Microsoft SharePoint Online. Which principle should they implement?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Apply the principle of least privilege
The principle of least privilege ensures that users have only the minimum permissions necessary to perform their tasks, which directly limits access to sensitive data. Option B (RBAC) is a method to enforce least privilege, but the question asks for the principle itself. Option C (MFA) adds authentication security but does not control permissions. Option D (defense in depth) is a broader security strategy, not specifically about permission minimization.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Apply the principle of least privilege
Why this is correct
The principle of least privilege (PoLP) dictates that users, programs, or processes should be granted only the minimum necessary permissions to perform their specific tasks and nothing more. This fundamental security concept minimizes the attack surface by reducing the potential impact of a compromised account or system. By strictly limiting access, PoLP ensures that only users with appropriate authorization can perform specific actions, directly addressing the company's goal.
- ✗
Assign roles based on job function using role-based access control (RBAC)
Why it's wrong here
Role-based access control (RBAC) is a specific access management mechanism that assigns permissions to roles, which are then assigned to users based on their job functions. While RBAC is an effective method for implementing and enforcing the principle of least privilege at scale, it is a practical tool or framework, not the overarching security principle itself. The question asks for the underlying principle guiding the permission strategy, not a specific implementation technique.
- ✗
Enable multi-factor authentication (MFA) for all users
Why it's wrong here
Multi-factor authentication (MFA) significantly enhances security by requiring users to provide two or more verification factors to gain access to an account or system. While MFA strengthens the authentication process, confirming a user's identity more robustly, it does not inherently control or limit the permissions that user possesses once authenticated. MFA ensures who can log in, but not what they can do after logging in, which is the focus of appropriate permissions.
- ✗
Implement defense in depth
Why it's wrong here
Defense in depth is a comprehensive security strategy that employs multiple, overlapping security controls to protect assets. This layered approach ensures that if one security control fails, another is in place to prevent or detect an attack. While a crucial overall security philosophy, defense in depth is a broad strategy and does not specifically address the granular control or minimization of user permissions, which is the core requirement of ensuring "only users with appropriate permissions."
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Defense in depth
Defense in depth is a cybersecurity strategy that uses multiple layers of security controls to protect information and systems, so if one layer fails, another layer is already in place to stop the attack.
Key term
RBAC
RBAC is a method of restricting network access based on the roles of individual users within an organization, where permissions are assigned to roles rather than to individuals directly.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.