SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A healthcare organization stores sensitive patient records in a cloud database. The database is encrypted at rest using AES-256. If an attacker gains access to the physical storage media, they cannot read the data. Which security concept does this encryption primarily provide?
⚠ Common exam trap
It's easy for candidates to confuse encryption at rest with integrity controls, mistakenly thinking encryption prevents modification, when in fact encryption only ensures confidentiality and does not provide tamper detection.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Encryption at rest using AES-256 ensures that data stored on physical media is unreadable without the decryption key. If an attacker gains physical access to the storage media, the ciphertext cannot be deciphered, directly protecting the secrecy of the data. This aligns with the security goal of confidentiality, which prevents unauthorized disclosure of information.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confidentiality
Why this is correct
Encryption is a primary control for ensuring confidentiality by transforming data into an unreadable format, known as ciphertext. This process prevents unauthorized individuals from accessing or understanding the sensitive patient records, even if they manage to intercept or steal the encrypted data. Only authorized parties possessing the correct decryption key can revert the data to its original, readable form, thereby protecting against unauthorized disclosure.
- ✗
Integrity
Why it's wrong here
While encryption protects data from unauthorized viewing, it does not inherently guarantee integrity. An attacker could potentially modify encrypted data without detection if there are no additional mechanisms like cryptographic hashing or digital signatures in place. Integrity specifically ensures that data has not been tampered with or altered during storage or transmission, which requires verification that the data remains unchanged from its original state.
When this WOULD be correct
A question asking which security concept is provided by hashing or digital signatures to ensure data has not been altered during transmission or storage would make integrity the correct answer.
- ✗
Availability
Why it's wrong here
Availability focuses on ensuring that authorized users can reliably access systems and data when required, without undue delay or interruption. While encryption is crucial for security, it does not directly contribute to availability; in fact, poor implementation or loss of encryption keys could even hinder access. Availability is typically addressed through measures like redundancy, backup and recovery strategies, and robust infrastructure design.
When this WOULD be correct
In a question about ensuring that a cloud database remains accessible during a DDoS attack, the correct answer would be availability, as it focuses on uptime and access despite disruptions.
- ✗
Authorization
Why it's wrong here
Authorization is a distinct security principle that involves determining and enforcing what actions an authenticated user or system is permitted to perform on a resource. It is a pre-access control mechanism that grants or denies specific rights, such as read or write access, based on defined policies and user roles. Encryption, conversely, protects the data's content itself, regardless of whether an entity was authorized to access the encrypted file, it still cannot read it without the key.
When this WOULD be correct
A question like 'Which security concept is enforced by requiring a user to authenticate before accessing a database?' would make Authorization correct, as it involves granting or denying access based on identity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ConfidentialityCorrect answer▾
Why this is correct
Encryption is a primary control for ensuring confidentiality by transforming data into an unreadable format, known as ciphertext. This process prevents unauthorized individuals from accessing or understanding the sensitive patient records, even if they manage to intercept or steal the encrypted data. Only authorized parties possessing the correct decryption key can revert the data to its original, readable form, thereby protecting against unauthorized disclosure.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
Encryption at rest protects data from being read, which is a confidentiality concern, not integrity. Integrity ensures data is not tampered with, but encryption alone does not prevent modification.
★ When this WOULD be the correct answer
A question asking which security concept is provided by hashing or digital signatures to ensure data has not been altered during transmission or storage would make integrity the correct answer.
Why candidates choose this
Candidates may confuse encryption with integrity because both involve cryptographic techniques, but encryption primarily protects confidentiality, while integrity is about detecting unauthorized changes.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
Encryption at rest protects data from being read, which is a confidentiality concern, not availability. Availability ensures data is accessible when needed, which encryption does not directly address.
★ When this WOULD be the correct answer
In a question about ensuring that a cloud database remains accessible during a DDoS attack, the correct answer would be availability, as it focuses on uptime and access despite disruptions.
Why candidates choose this
Candidates may confuse encryption with overall security, thinking it contributes to availability by preventing data loss from theft, but encryption primarily protects confidentiality, not system uptime.
✗AuthorizationWrong answer — click to see why▾
Why this is wrong here
Authorization controls who can access the data, but encryption at rest protects data from being read even if physical access is gained. The question asks about reading data from physical media, which is a confidentiality issue, not authorization.
★ When this WOULD be the correct answer
A question like 'Which security concept is enforced by requiring a user to authenticate before accessing a database?' would make Authorization correct, as it involves granting or denying access based on identity.
Why candidates choose this
Candidates may confuse encryption with access control, thinking that encryption 'authorizes' only certain users to read data, but encryption primarily ensures confidentiality, not authorization.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Advanced Encryption Standard
Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm that protects electronic data by converting readable information into a scrambled format that can only be unscrambled with the correct secret key.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.