SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A hospital encrypts patient data stored in a database using AES-256 encryption. If an attacker manages to copy the database file, they cannot read the protected information. Which security goal is primarily achieved by this encryption measure?
⚠ Common exam trap
Microsoft often tests the distinction between confidentiality and integrity, where candidates mistakenly think encryption also verifies that data hasn't been changed, but encryption alone provides no tamper detection—that requires a separate integrity mechanism like HMAC or digital signatures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
AES-256 encryption ensures that even if an attacker gains unauthorized access to the database file, the data remains unreadable without the decryption key. This directly protects the secrecy of the patient data, which is the definition of confidentiality. In the context of the SC-900, encryption at rest is a primary mechanism for achieving confidentiality of stored data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confidentiality
Why this is correct
In the context of the CIA triad, confidentiality is the principle that prevents unauthorized disclosure of information, ensuring only authorized entities can access sensitive data. Encrypting patient data with AES directly addresses this by transforming the data into an unintelligible format for anyone without the proper decryption key. This ensures that even if an attacker gains unauthorized access to the database files, the sensitive patient information remains protected from unauthorized viewing or exfiltration.
- ✗
Integrity
Why it's wrong here
Integrity ensures that data has not been altered or tampered with. While some encryption methods provide integrity guarantees (e.g., authenticated encryption), the primary purpose of encrypting stored data is to protect its confidentiality, not its integrity.
When this WOULD be correct
A question asking which security goal is achieved by hashing or digital signatures to verify that data has not been altered during transmission would have integrity as the correct answer.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can access data when needed. Encryption does not inherently affect availability; in fact, if encryption keys are lost, availability can be negatively impacted. The scenario focuses on preventing unauthorized reads, not on ensuring access.
When this WOULD be correct
A hospital implements redundant servers and backup power to ensure patient records are accessible even during a power outage. Which security goal is primarily achieved?
- ✗
Auditability
Why it's wrong here
Auditability pertains to the capability of an information system to record and review events, such as data access attempts, modifications, or system actions, to establish accountability and detect anomalies. While crucial for security, encryption, like AES, is a data protection mechanism that scrambles data content, not an activity logging or tracking service. Implementing auditability requires separate logging and monitoring solutions that record who accessed the encrypted data, when, and from where, independent of the encryption process itself.
When this WOULD be correct
A question asking which security goal is achieved by implementing database access logs that record all read and write operations, enabling forensic analysis after a breach.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓ConfidentialityCorrect answer▾
Why this is correct
In the context of the CIA triad, confidentiality is the principle that prevents unauthorized disclosure of information, ensuring only authorized entities can access sensitive data. Encrypting patient data with AES directly addresses this by transforming the data into an unintelligible format for anyone without the proper decryption key. This ensures that even if an attacker gains unauthorized access to the database files, the sensitive patient information remains protected from unauthorized viewing or exfiltration.
✗IntegrityWrong answer — click to see why▾
Why this is wrong here
Encryption protects data from unauthorized access, which is confidentiality. Integrity ensures data is not tampered with, but encryption alone does not prevent modification.
★ When this WOULD be the correct answer
A question asking which security goal is achieved by hashing or digital signatures to verify that data has not been altered during transmission would have integrity as the correct answer.
Why candidates choose this
Candidates may confuse encryption with integrity because both involve cryptographic techniques, but encryption primarily protects secrecy, not data integrity.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
Encryption protects data from unauthorized access, not from loss or downtime. Availability concerns ensuring systems and data are accessible when needed, which encryption does not directly address.
★ When this WOULD be the correct answer
A hospital implements redundant servers and backup power to ensure patient records are accessible even during a power outage. Which security goal is primarily achieved?
Why candidates choose this
Candidates may confuse encryption with overall security, thinking it ensures data is always available, but encryption only protects confidentiality, not uptime.
✗AuditabilityWrong answer — click to see why▾
Why this is wrong here
Auditability refers to the ability to track and review actions, such as who accessed or modified data. Encryption alone does not provide logs or tracking; it only prevents unauthorized reading of data, which is confidentiality.
★ When this WOULD be the correct answer
A question asking which security goal is achieved by implementing database access logs that record all read and write operations, enabling forensic analysis after a breach.
Why candidates choose this
Candidates may confuse encryption with audit controls because both are security measures, but auditability requires logging and monitoring, not just data protection.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Decryption
Decryption is the process of converting encrypted or scrambled data back into its original, readable form using a specific key or method.
Key term
Advanced Encryption Standard
Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm that protects electronic data by converting readable information into a scrambled format that can only be unscrambled with the correct secret key.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.