SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user authenticates with a smart card and is then granted access to a specific database based on their job role in the finance department. Which security concept describes the process of determining what the authenticated user is allowed to do?
⚠ Common exam trap
A common mix-up: candidates confuse authentication with authorization; candidates often pick 'Authentication' because they focus on the smart card step, but the question explicitly asks about determining what the user is allowed to do, which is authorization.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
Authorization is the security concept that determines what an authenticated user is permitted to do. In this scenario, after the user authenticates with a smart card, the system checks their job role in the finance department against access control lists (ACLs) or role-based access control (RBAC) policies to grant access to the specific database. This is distinct from authentication, which only verifies identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authentication
Why it's wrong here
Authentication is the initial process where a system verifies the identity of a user or entity, typically by validating credentials like a smart card, password, or biometric scan. While the smart card successfully performs this identity verification, the question specifically asks about the subsequent step of *granting* access based on that verified identity, which falls outside the scope of authentication itself.
- ✓
Authorization
Why this is correct
Authorization is the critical security process that determines what an authenticated user is permitted to do or access within a system. After a user successfully authenticates with a smart card, the system consults predefined policies, roles, and permissions to evaluate whether that user has the necessary rights to perform a specific action, such as accessing a particular database. This evaluation directly leads to the decision of whether access is granted or denied.
- ✗
Accounting
Why it's wrong here
Accounting, often referred to as auditing or accountability, involves the systematic logging and tracking of user activities, resource usage, and system events. Its purpose is to create an immutable record of 'who did what, when, and where' for security analysis, compliance, and forensic investigations. Unlike authorization, accounting does not make decisions about granting access but rather records the outcomes and actions *after* access decisions have been made and activities performed.
- ✗
Encryption
Why it's wrong here
Encryption is a cryptographic technique that transforms data into an unreadable format, known as ciphertext, to protect its confidentiality and integrity from unauthorized disclosure. While essential for securing data both at rest and in transit, encryption itself does not determine or control *who* is allowed to access a system or resource. It acts as a protective measure for the data, rather than an access control mechanism based on user identity or permissions.
Visual reference
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Role
A role is a named set of permissions that can be assigned to users or groups to control access to resources in an IT environment.
Key term
Identity
Identity is the unique set of attributes that defines a user, device, or service in a computer system, determining what they can access and do.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.