SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A financial institution uses digital signatures to ensure that a transaction record has not been altered after it was processed. Which security principle is primarily addressed?
⚠ Common exam trap
Candidates often confuse non-repudiation (which focuses on proving the origin of the signature) with integrity (which focuses on proving the data has not been altered), but the question's wording 'has not been altered' points directly to integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
B. Integrity
Digital signatures use asymmetric cryptography (e.g., RSA or ECDSA) to create a hash of the transaction record, which is then encrypted with the sender's private key. Any alteration to the record after signing would cause the hash verification to fail, directly ensuring data integrity. This is why option B is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A. Confidentiality
Why it's wrong here
Confidentiality is the principle of preventing unauthorized access to information, ensuring that only authorized individuals can view or read sensitive data. While digital signatures use encryption, they encrypt only the document's hash, not the entire document content itself. Therefore, a digital signature does not prevent an unauthorized party from reading the document, making it unrelated to confidentiality.
When this WOULD be correct
A question asking which principle is primarily addressed by encrypting data at rest or in transit, or by using access controls to restrict data access, would have confidentiality as the correct answer.
- ✓
B. Integrity
Why this is correct
Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.
- ✗
C. Availability
Why it's wrong here
Availability ensures that authorized users can access information and systems when needed, without interruption or delay. Digital signatures do not directly impact the uptime, accessibility, or operational status of data or services. Their function is purely related to verifying the authenticity and integrity of digital information, not its continuous presence or readiness for use.
When this WOULD be correct
A question asking which security principle is addressed by implementing redundant servers and backup power supplies to ensure a system remains operational during a power outage would have availability as the correct answer.
- ✗
D. Non-repudiation
Why it's wrong here
Non-repudiation prevents a party from falsely denying that they sent a message or performed an action. While digital signatures contribute to non-repudiation by uniquely linking the signature to the sender's private key, the question's phrasing "ensure that a [document]" focuses more directly on the state of the document itself rather than proving the sender's identity to prevent denial. The primary and most direct security property enforced by verifying a digital signature on a document is its unaltered state.
When this WOULD be correct
A question asking which security principle ensures that a sender cannot deny having sent a digitally signed message, or that a recipient cannot deny receipt, would have non-repudiation as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓B. IntegrityCorrect answer▾
Why this is correct
Integrity ensures that data has not been tampered with or altered from its original state. Digital signatures achieve this by creating a unique cryptographic hash of the document, which is then encrypted with the sender's private key. Any subsequent modification to the document would result in a different hash value, immediately revealing that the data's integrity has been compromised upon verification.
✗A. ConfidentialityWrong answer — click to see why▾
Why this is wrong here
Digital signatures ensure data has not been altered, which addresses integrity, not confidentiality. Confidentiality is about preventing unauthorized access to data, not detecting changes.
★ When this WOULD be the correct answer
A question asking which principle is primarily addressed by encrypting data at rest or in transit, or by using access controls to restrict data access, would have confidentiality as the correct answer.
Why candidates choose this
Candidates may confuse digital signatures with encryption, thinking they both protect data from unauthorized viewing, but signatures focus on integrity, not secrecy.
✗C. AvailabilityWrong answer — click to see why▾
Why this is wrong here
The question focuses on ensuring a transaction record has not been altered, which is the definition of integrity. Availability is about ensuring systems and data are accessible when needed, not about preventing unauthorized modification.
★ When this WOULD be the correct answer
A question asking which security principle is addressed by implementing redundant servers and backup power supplies to ensure a system remains operational during a power outage would have availability as the correct answer.
Why candidates choose this
Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that preventing alteration also ensures the data remains available in its correct form, but availability specifically refers to uptime and accessibility, not data correctness.
✗D. Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that a party cannot deny having performed an action, such as signing a transaction. The question focuses on preventing alteration after processing, which is integrity, not on denying the action itself.
★ When this WOULD be the correct answer
A question asking which security principle ensures that a sender cannot deny having sent a digitally signed message, or that a recipient cannot deny receipt, would have non-repudiation as the correct answer.
Why candidates choose this
Candidates often associate digital signatures with non-repudiation because signatures provide proof of origin, but they overlook that the question specifically addresses alteration (integrity) rather than denial of action.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.