SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A security manager wants to ensure that an employee who sends an email cannot later deny having sent it. Which security concept and associated technology is best suited to achieve this?
⚠ Common exam trap
Test-takers frequently confuse integrity (hashing) with non-repudiation, not realizing that a hash alone lacks sender identity binding—only a digital signature provides the cryptographic proof of origin needed to prevent denial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Non-repudiation, achieved through digital signatures
Non-repudiation ensures that a party cannot deny an action, such as sending an email. Digital signatures, which use asymmetric cryptography (e.g., RSA or ECDSA) and a hash of the message, provide cryptographic proof of the sender's identity and message integrity, making denial impossible.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality, achieved through encryption
Why it's wrong here
Confidentiality, achieved through encryption, primarily ensures that data remains private and unreadable to unauthorized parties. While encryption protects the content of the message from disclosure, it does not inherently provide proof of the sender's identity or prevent them from denying authorship. Multiple parties might possess the decryption key, or the encryption might be applied by an intermediary, making it impossible to definitively attribute the origin to a specific individual.
When this WOULD be correct
A question asking which security concept ensures that only authorized recipients can read an email, with the technology being encryption.
- ✗
Integrity, achieved through hashing
Why it's wrong here
Integrity, achieved through hashing, generates a fixed-size unique digest of data, serving as a fingerprint to detect any unauthorized alteration during transit. While hashing confirms data integrity by verifying that the message has not been tampered with, it does not inherently authenticate the sender. A hash alone does not cryptographically bind the message to a specific individual's identity, allowing a sender to still deny having originated the message, even if its integrity is proven.
When this WOULD be correct
A question asking which security concept ensures that data has not been tampered with during transmission, with the associated technology being hashing to verify integrity.
- ✓
Non-repudiation, achieved through digital signatures
Why this is correct
Non-repudiation, achieved through digital signatures, cryptographically links a sender to a specific message, preventing them from falsely denying authorship. By using the sender's unique private key to sign a message's hash, an undeniable proof of origin is created. The recipient can verify this signature using the sender's public key, confirming both the sender's identity and the message's integrity. This mechanism is crucial for legal and financial transactions where accountability is paramount.
- ✗
Access control, achieved through permissions
Why it's wrong here
Access control, achieved through permissions, regulates who can perform specific actions (e.g., read, write, execute) on resources. While essential for security by enforcing authorization policies, access control focuses on preventing unauthorized actions rather than proving that an authorized action was performed by a specific individual. It does not create an undeniable, cryptographically verifiable link between an action and the actor that would prevent repudiation.
When this WOULD be correct
A question asking: 'Which security concept ensures that only authorized users can view sensitive data?' would make access control correct, typically implemented through permissions or role-based access control.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Non-repudiation, achieved through digital signaturesCorrect answer▾
Why this is correct
Non-repudiation, achieved through digital signatures, cryptographically links a sender to a specific message, preventing them from falsely denying authorship. By using the sender's unique private key to sign a message's hash, an undeniable proof of origin is created. The recipient can verify this signature using the sender's public key, confirming both the sender's identity and the message's integrity. This mechanism is crucial for legal and financial transactions where accountability is paramount.
✗Confidentiality, achieved through encryptionWrong answer — click to see why▾
Why this is wrong here
Confidentiality (encryption) protects data from unauthorized access, but does not provide proof of origin or prevent the sender from denying they sent the email.
★ When this WOULD be the correct answer
A question asking which security concept ensures that only authorized recipients can read an email, with the technology being encryption.
Why candidates choose this
Candidates may confuse encryption with digital signatures, or think that encrypting the email also authenticates the sender.
✗Integrity, achieved through hashingWrong answer — click to see why▾
Why this is wrong here
Integrity ensures data has not been altered, but does not prevent a sender from denying they sent a message. Non-repudiation is required to prove the origin of the email.
★ When this WOULD be the correct answer
A question asking which security concept ensures that data has not been tampered with during transmission, with the associated technology being hashing to verify integrity.
Why candidates choose this
Candidates may confuse integrity with non-repudiation because both involve verifying data authenticity, but integrity focuses on data unchanged, not sender identity.
✗Access control, achieved through permissionsWrong answer — click to see why▾
Why this is wrong here
Access control and permissions manage who can access resources, but they do not provide proof of origin or prevent denial of sending an email. Non-repudiation is required to prevent a sender from denying they sent a message.
★ When this WOULD be the correct answer
A question asking: 'Which security concept ensures that only authorized users can view sensitive data?' would make access control correct, typically implemented through permissions or role-based access control.
Why candidates choose this
Candidates may confuse access control with non-repudiation because both involve security policies, but access control focuses on authorization, not on irrefutable proof of action.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Asymmetric Encryption Algorithm Comparison
| Algorithm | Key Exchange | Signatures | Equivalent Security Key | Notes |
|---|---|---|---|---|
| RSA-3072 | Yes | Yes | 128-bit | Widely deployed; slow for bulk data |
| ECDSA P-256 | No | Yes | 128-bit | Fast signatures; standard TLS certs |
| ECDH / ECDHE | Yes | No | 128-bit | Perfect forward secrecy in TLS 1.3 |
| DH / DHE | Yes | No | 128-bit (3072-bit key) | Replaced by ECDHE in modern TLS |
| Ed25519 | No | Yes | ~128-bit | SSH keys, modern PKI |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Non-repudiation
Non-repudiation is a security principle that ensures a party in a digital transaction cannot deny their involvement or the authenticity of their digital signature.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.