SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A multinational company stores customer data across multiple Azure regions. A new regulation requires that customer data must remain within the country's borders and cannot be transferred abroad. Which concept does this regulation primarily relate to?
⚠ Common exam trap
It's easy for candidates to confuse Data Sovereignty (legal/jurisdictional control) with Data Residency (physical storage location), but the regulation's explicit focus on 'cannot be transferred abroad' makes sovereignty the correct concept.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Sovereignty
Data Sovereignty is the correct answer because the regulation mandates that customer data must remain within the country's borders and cannot be transferred abroad. This legal and compliance concept asserts that data is subject to the laws and governance structures of the nation where it is physically stored, directly addressing cross-border transfer restrictions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Sovereignty
Why this is correct
Data sovereignty dictates that data is subject to the laws and governance of the nation where it is physically stored or processed. This legal principle directly impacts cross-border data transfers, as companies must ensure that moving data to another jurisdiction does not violate the originating country's privacy, security, or regulatory frameworks. It is a critical consideration for multinational corporations handling sensitive customer information, ensuring compliance with local legal requirements.
- ✗
Data Residency
Why it's wrong here
Data residency refers to the physical or geographic location where data is stored, often a contractual requirement specified by customers or regulations. While a prerequisite for data sovereignty to apply, data residency itself does not inherently impose legal restrictions on data transfer or dictate the governing legal jurisdiction. It simply defines the storage location, which then enables the application of local laws if sovereignty is also a concern.
- ✗
Data Retention
Why it's wrong here
Data retention policies define the duration for which specific types of data must be kept, often mandated by legal, regulatory, or business compliance requirements. These policies govern the data's lifecycle, specifying when it should be archived, deleted, or destroyed, rather than dictating its geographic storage location or legal transferability across borders. Its primary focus is on data lifecycle management and compliance with time-based storage obligations.
- ✗
Data Classification
Why it's wrong here
Data classification is the process of categorizing data based on its sensitivity, value, and regulatory requirements, assigning labels like 'confidential' or 'public.' This categorization helps determine appropriate security controls, access permissions, and handling procedures for the data throughout its lifecycle. However, data classification does not inherently impose geographic storage restrictions or legal limitations on where data can be transferred across national boundaries.
Go deeper
Related to this question
Learn chapter
Compliance Concepts
Key term
General Data Protection Regulation
A European Union law that gives individuals control over their personal data and sets strict rules for how organizations collect, store, and process that data.
Key term
Governance
Governance is the framework of policies, processes, and controls that ensures IT activities align with business goals and comply with regulations.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.