SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A company has a document management system. The security policy requires that a user in the Sales department can only view documents related to sales and cannot access documents in the Finance or HR folders. Which security principle is being applied?
⚠ Common exam trap
Microsoft often tests least privilege by contrasting it with defense in depth, but the trap here is that candidates confuse a single access restriction (least privilege) with a multi-layered security strategy (defense in depth).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Least privilege
The security policy restricts a Sales user's access to only sales-related documents, explicitly denying access to Finance and HR folders. This aligns with the principle of least privilege, which mandates that users be granted only the minimum permissions necessary to perform their job functions. In Microsoft 365, this is implemented via role-based access control (RBAC) or sensitivity labels that enforce read-only access on specific SharePoint document libraries or folders.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Availability
Why it's wrong here
Availability, a core component of the CIA triad, ensures that authorized users can reliably access information systems and data when needed. While crucial for operational continuity, the scenario describes a security policy focused on restricting access to specific data based on necessity, rather than guaranteeing system uptime or the general accessibility of resources. The policy's primary concern is access control, not the continuous operational state of the system.
When this WOULD be correct
A company's e-commerce platform must guarantee 99.99% uptime during peak shopping season. Which security principle is most critical?
- ✓
Least privilege
Why this is correct
The principle of least privilege dictates that every user, process, and program should be granted only the minimum necessary permissions to perform its legitimate function. In a document management system, this means a security policy would restrict access to documents strictly based on a user's role and specific job requirements, preventing unauthorized viewing or modification. This directly aligns with a policy requiring restricted access to documents to minimize potential misuse or data breaches.
- ✗
Defense in depth
Why it's wrong here
Defense in depth is a comprehensive security strategy that layers multiple, independent security controls to protect assets, ensuring that if one control fails, others remain to provide protection. This approach typically involves diverse mechanisms like firewalls, intrusion detection systems, and physical security. However, the scenario specifically mentions a single security policy within a document management system focused solely on access restriction, not the implementation of a multi-layered security architecture.
When this WOULD be correct
Defense in depth would be correct in a question like: 'A company implements firewalls, antivirus, and intrusion detection to protect its network. Which security principle is being applied?'
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides undeniable proof that a specific action or event occurred, preventing an entity from falsely denying its involvement later. This is commonly achieved through cryptographic methods like digital signatures or robust audit trails. The security policy described in the scenario is concerned with proactively defining and enforcing who can access documents, rather than establishing irrefutable evidence of past actions or preventing denial of those actions.
When this WOULD be correct
A company requires that when a sales manager approves a contract, the action is logged with a digital signature so the manager cannot later deny approval. Which security principle is being applied?
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Least privilegeCorrect answer▾
Why this is correct
The principle of least privilege dictates that every user, process, and program should be granted only the minimum necessary permissions to perform its legitimate function. In a document management system, this means a security policy would restrict access to documents strictly based on a user's role and specific job requirements, preventing unauthorized viewing or modification. This directly aligns with a policy requiring restricted access to documents to minimize potential misuse or data breaches.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
The question is about restricting access to specific documents based on role, which is a permission control issue, not about ensuring system uptime or data accessibility.
★ When this WOULD be the correct answer
A company's e-commerce platform must guarantee 99.99% uptime during peak shopping season. Which security principle is most critical?
Why candidates choose this
Candidates may confuse 'availability' with 'access control', thinking that restricting access is about making data available only to authorized users, but availability specifically refers to system reliability and uptime.
✗Defense in depthWrong answer — click to see why▾
Why this is wrong here
Defense in depth is a layered security strategy using multiple controls, not a principle about granting minimal access rights. The question specifically asks about restricting user access to only necessary documents, which is least privilege.
★ When this WOULD be the correct answer
Defense in depth would be correct in a question like: 'A company implements firewalls, antivirus, and intrusion detection to protect its network. Which security principle is being applied?'
Why candidates choose this
Candidates may confuse defense in depth with least privilege because both involve security controls, but defense in depth focuses on multiple layers rather than access minimization.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that a user cannot deny having performed an action (e.g., signing a document), but the question is about restricting access based on role, not about accountability for actions.
★ When this WOULD be the correct answer
A company requires that when a sales manager approves a contract, the action is logged with a digital signature so the manager cannot later deny approval. Which security principle is being applied?
Why candidates choose this
Candidates may confuse access control with accountability, thinking that restricting access also prevents denial of access, but non-repudiation is about proving actions, not permissions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Least privilege
Least privilege is a security principle that means giving users, systems, or programs only the minimum permissions they need to do their job and nothing more.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.