SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security analyst downloads a software installer from a vendor's website. To ensure the file has not been tampered with during transmission, the analyst compares the SHA-256 hash of the downloaded file against the hash published on the vendor's official site. This practice primarily validates which security goal?
⚠ Common exam trap
A common mix-up: candidates confuse integrity with authentication, thinking that verifying a hash proves the file came from the vendor, but hashing alone does not authenticate the source—it only confirms the file has not changed since the hash was computed.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrity
Comparing the SHA-256 hash of the downloaded installer against the vendor's published hash verifies that the file has not been altered during transmission. This directly validates integrity, which ensures data remains unchanged from its original source. Hashing is a one-way cryptographic function; any change in the file, even a single bit, produces a completely different hash value, making tampering detectable.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality focuses on preventing unauthorized disclosure of sensitive information, ensuring that only authorized individuals or systems can view or access specific data. When downloading a software installer, the primary concern is not typically about keeping the installer file itself secret from unauthorized viewing. Instead, the critical issue is ensuring its content has not been maliciously modified, which is a matter of integrity, not confidentiality.
When this WOULD be correct
A question asking which security goal is primarily achieved by encrypting the downloaded file during transmission (e.g., using HTTPS) would make confidentiality the correct answer, as encryption protects data from being read by unauthorized parties.
- ✓
Integrity
Why this is correct
When a security analyst downloads software, ensuring its integrity means verifying that the installer file has not been tampered with, corrupted, or maliciously altered during transit or storage. This is crucial to prevent the execution of unauthorized code or unintended software behavior. Comparing a cryptographic hash (like SHA256) provided by the vendor with the hash of the downloaded file is the primary method to confirm that the software's integrity remains uncompromised from its original source.
- ✗
Availability
Why it's wrong here
Availability in cybersecurity refers to the principle that authorized users and systems can access information and resources when and where they are needed. While the act of downloading software implies the file is accessible, the core concern addressed by this question is not whether the file can be obtained, but rather whether its content is trustworthy and unaltered. Availability does not address the authenticity or modification status of the software itself.
When this WOULD be correct
A question asks: 'A company implements redundant servers and backup power to ensure users can always access the application. Which security goal is being addressed?' In that scenario, availability is the correct answer.
- ✗
Authentication
Why it's wrong here
Authentication is the process of verifying the identity of a user, system, or process attempting to access a resource or service. While the vendor's website might require authentication to download the software, or the software itself might be digitally signed by the vendor (which involves authentication of the signer), the direct act of downloading the installer primarily raises concerns about the integrity of the file's content. Authentication confirms *who* is accessing or providing something, not *what* has happened to the data itself after it was created.
When this WOULD be correct
A user logs into a system using a smart card and PIN. This validates the user's identity, which is the goal of authentication. The question would ask which security goal is achieved by verifying the user's credentials before granting access.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓IntegrityCorrect answer▾
Why this is correct
When a security analyst downloads software, ensuring its integrity means verifying that the installer file has not been tampered with, corrupted, or maliciously altered during transit or storage. This is crucial to prevent the execution of unauthorized code or unintended software behavior. Comparing a cryptographic hash (like SHA256) provided by the vendor with the hash of the downloaded file is the primary method to confirm that the software's integrity remains uncompromised from its original source.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
Comparing hashes verifies that the file has not been altered, which is a property of integrity, not confidentiality. Confidentiality concerns preventing unauthorized access to data, not detecting tampering.
★ When this WOULD be the correct answer
A question asking which security goal is primarily achieved by encrypting the downloaded file during transmission (e.g., using HTTPS) would make confidentiality the correct answer, as encryption protects data from being read by unauthorized parties.
Why candidates choose this
Candidates may confuse hashing with encryption or think that any security measure involving files relates to keeping them secret, rather than understanding that hash comparison specifically detects changes (integrity).
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
Availability ensures that systems and data are accessible when needed, but comparing hashes does not relate to uptime or accessibility; it verifies that the file has not been altered.
★ When this WOULD be the correct answer
A question asks: 'A company implements redundant servers and backup power to ensure users can always access the application. Which security goal is being addressed?' In that scenario, availability is the correct answer.
Why candidates choose this
Candidates may confuse integrity with availability because both involve protecting data, but availability focuses on access and uptime, not on detecting unauthorized changes.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
Authentication verifies the identity of a user or system, not the integrity of data. Comparing hashes confirms the file hasn't been altered, which is an integrity check, not an authentication process.
★ When this WOULD be the correct answer
A user logs into a system using a smart card and PIN. This validates the user's identity, which is the goal of authentication. The question would ask which security goal is achieved by verifying the user's credentials before granting access.
Why candidates choose this
Candidates may confuse authentication with integrity because both involve verification processes, and the hash comparison might be mistakenly seen as verifying the file's origin (authenticity) rather than its unaltered state.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.