SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A hospital stores patient medical records electronically. An attacker gains access to the system and modifies patient diagnoses. Which principle of the CIA triad has been violated?
⚠ Common exam trap
Many exam-takers confuse 'access' with 'confidentiality' and choose A, but the key is the modification of data, which is a clear integrity violation, not just unauthorized viewing.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrity
The CIA triad's Integrity principle ensures that data is not modified by unauthorized parties. In this scenario, the attacker altered patient diagnoses, which directly violates data integrity. Confidentiality (unauthorized disclosure) and Availability (denial of service) are not the primary concerns here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality focuses on preventing unauthorized disclosure or access to information, ensuring that only authorized individuals can view sensitive data. While patient medical records are inherently confidential, the scenario describes an attacker actively modifying patient diagnoses, not illicitly viewing or leaking them. Therefore, the primary security principle violated is not the unauthorized revelation of information, but rather the alteration of its content.
- ✓
Integrity
Why this is correct
Data integrity ensures that information remains accurate, complete, and unaltered throughout its lifecycle, protecting against unauthorized modification or destruction. In this scenario, an attacker directly modified patient diagnoses, which fundamentally compromises the trustworthiness and reliability of the medical records. This unauthorized alteration is a clear violation of the integrity principle, as the data no longer reflects its original, correct state.
- ✗
Availability
Why it's wrong here
Availability guarantees that authorized users can access information and systems when required, ensuring timely and reliable access to resources. The scenario describes data modification, which does not inherently prevent access to the records themselves, even if their content is now incorrect. There is no indication of a denial of service attack, system downtime, or any other impediment preventing authorized personnel from retrieving the (albeit altered) patient records.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides irrefutable proof that a specific action or event has occurred, preventing an entity from falsely denying their involvement. While an attacker did perform an action (modification), the primary concern in the scenario is the compromised state of the data after the unauthorized change, not the ability to prove who made the change or prevent them from denying it. The core violation is the data's alteration, not the lack of accountability for the action itself.
Go deeper
Related to this question
Learn chapter
Conditional Access Policies
Key term
DoS
A cyberattack that floods a target with traffic or requests to exhaust its resources, making it unavailable to legitimate users.
Key term
Confidentiality Integrity and Availability
The CIA Triad is a foundational security model that ensures data is kept secret, unaltered, and accessible when needed.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.