SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user authenticates to a company's network by entering their password and then approving a push notification on their mobile phone. After authentication, the user attempts to access a shared folder containing financial reports. The access is denied because the user's account is not a member of the 'Finance' group. Which security concept is demonstrated when the user is denied access to the folder?
⚠ Common exam trap
Candidates often confuse authentication (proving who you are) with authorization (what you are allowed to do), especially when the question includes a multi-factor authentication step that seems to 'grant' access, but the denial is purely an authorization failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
Authorization is the security concept that determines what resources a user is allowed to access after their identity has been verified. In this scenario, the user successfully authenticated but was denied access to the financial reports folder because their account lacked the necessary permissions—specifically, membership in the 'Finance' group. This access control decision is the essence of authorization, which enforces policies based on identity attributes like group membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authentication
Why it's wrong here
Authentication is the foundational security process of verifying a user's or entity's claimed identity. This typically involves presenting credentials like a username and password, a smart card, or biometric data, often combined with multi-factor authentication (MFA). The scenario describes a user who has already successfully authenticated to the network but is subsequently denied access to a specific resource, indicating that identity verification has already occurred.
When this WOULD be correct
Authentication would be correct if the question described a scenario where the user fails to prove their identity, such as entering an incorrect password or failing a biometric scan, and is therefore denied access to the network.
- ✓
Authorization
Why this is correct
Authorization is the security process that determines what actions an authenticated user or system is permitted to perform on a resource. After a user successfully proves their identity, the system evaluates their assigned rights and privileges, often based on roles or group memberships. In this scenario, denying access to a folder because the user lacks the necessary group membership is a direct application of an authorization policy, enforcing access control based on established permissions.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation is a security principle that provides undeniable proof that a specific action or event has occurred and cannot be subsequently denied by the party involved. This is often achieved through robust logging, digital signatures, or cryptographic techniques that link an action to a specific identity. The scenario describes a user being prevented from performing an action due to insufficient permissions, not a situation where a party is attempting to deny a past action.
When this WOULD be correct
A user signs a digital contract using a private key, and later claims they did not sign it. The system provides proof of the signature, preventing denial. This demonstrates non-repudiation.
- ✗
Accounting
Why it's wrong here
Accounting, often referred to as auditing, is the process of tracking and logging user activities, resource access, and system events. Its primary purpose is to create an immutable record for security monitoring, compliance, and forensic analysis, detailing who did what, when, and where. While an access denial might be logged as an accounting event, the denial itself is an authorization decision, not the act of tracking or billing.
When this WOULD be correct
A user accesses a file server, and the system logs the access attempt, including timestamp, user identity, and file accessed. The question asks which concept is demonstrated by the logging of this activity.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuthorizationCorrect answer▾
Why this is correct
Authorization is the security process that determines what actions an authenticated user or system is permitted to perform on a resource. After a user successfully proves their identity, the system evaluates their assigned rights and privileges, often based on roles or group memberships. In this scenario, denying access to a folder because the user lacks the necessary group membership is a direct application of an authorization policy, enforcing access control based on established permissions.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
The user was denied access due to insufficient permissions (not being in the Finance group), which is an authorization decision, not authentication. Authentication only verifies identity, which already succeeded via password and push notification.
★ When this WOULD be the correct answer
Authentication would be correct if the question described a scenario where the user fails to prove their identity, such as entering an incorrect password or failing a biometric scan, and is therefore denied access to the network.
Why candidates choose this
Candidates often confuse authentication and authorization because both involve access control. They may think that being denied access is related to identity verification, not realizing that authentication already passed.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that a user cannot deny having performed an action, such as signing a document. The scenario describes access denial due to group membership, which is about authorization, not non-repudiation.
★ When this WOULD be the correct answer
A user signs a digital contract using a private key, and later claims they did not sign it. The system provides proof of the signature, preventing denial. This demonstrates non-repudiation.
Why candidates choose this
Candidates may confuse non-repudiation with authorization because both involve security controls, but non-repudiation focuses on accountability for actions, not access rights.
✗AccountingWrong answer — click to see why▾
Why this is wrong here
Accounting refers to tracking user activities and resource usage (e.g., logging access attempts), not to controlling access based on group membership. The denial here is due to lack of authorization, not accounting.
★ When this WOULD be the correct answer
A user accesses a file server, and the system logs the access attempt, including timestamp, user identity, and file accessed. The question asks which concept is demonstrated by the logging of this activity.
Why candidates choose this
Candidates may confuse 'accounting' with 'access control' because both involve user actions and permissions, but accounting is about auditing and logging, not enforcing access decisions.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Group
A group is a collection of users, devices, or other objects that are assigned permissions and policies together for simplified management in identity and governance systems like Microsoft Entra ID.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.