SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A financial organization implements a security control that logs every access attempt to sensitive financial records, including who accessed the data, when it was accessed, and from which device. The logs are regularly reviewed by the security team. This control primarily addresses which security concept?
⚠ Common exam trap
Watch out — candidates often confuse logging with confidentiality, thinking that tracking access prevents unauthorized viewing, when in fact logging only records the event and does not block the access itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Accountability
Accountability ensures that actions affecting sensitive data can be traced uniquely to an individual. By logging who accessed the data, when, and from which device, the organization creates an audit trail that holds users responsible for their actions. This directly supports non-repudiation and forensic analysis, which are the core goals of accountability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality focuses on preventing unauthorized disclosure of information, typically through access controls, encryption, and authentication mechanisms. While logs can record attempts at unauthorized access or successful breaches, they do not inherently prevent these events from occurring. Logging acts as a detective control, providing an audit trail for investigation rather than a preventative measure for confidentiality.
- ✗
Integrity
Why it's wrong here
Integrity ensures that data remains accurate, complete, and unaltered by unauthorized parties or processes. Logging records who accessed data and when, but it does not directly prevent data modification or guarantee the data's trustworthiness. Controls like hashing, digital signatures, and strict write permissions are primary mechanisms for maintaining data integrity, whereas logging serves to detect and investigate integrity breaches.
- ✗
Availability
Why it's wrong here
Logging primarily records system events and user actions, which can be useful for diagnosing availability issues after they occur. However, the act of logging itself does not directly ensure the continuous uptime, accessibility, or resilience of systems and data. Proactive measures like redundancy, fault tolerance, and disaster recovery are the primary controls for availability.
- ✓
Accountability
Why this is correct
Accountability is the ability to trace actions and events back to a specific entity, whether a user, process, or system. By meticulously recording access, modifications, and system events, logging creates an indispensable audit trail. This trail enables forensic analysis, compliance verification, and the attribution of responsibility, making it a foundational component for holding individuals and systems accountable for their actions within an organization.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
Key term
Accountability
Accountability is the security principle that ensures actions and identity are linked so that a person or system can be held responsible for their activities.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.