SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user logs into a company's application using their username and password. After logging in, the application checks whether the user belongs to the 'Admin' role before granting access to the user management page. Which security concept is primarily illustrated by the role check?
⚠ Common exam trap
Microsoft often tests the distinction between authentication and authorization by presenting a scenario where a user is already logged in and then a permission check occurs, leading candidates to mistakenly select 'authentication' because they focus on the login step rather than the subsequent access control decision.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
The role check after login determines what actions the authenticated user is allowed to perform, specifically whether they can access the user management page. This is the essence of authorization, which controls access to resources based on identity and assigned permissions. In Microsoft identity and access management, authorization is enforced via role-based access control (RBAC), where the application verifies the user's role claim (e.g., 'Admin') in the access token.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authentication
Why it's wrong here
Authentication is the foundational process of verifying a user's claimed identity. This typically involves presenting credentials like a username and password, a smart card, or a biometric scan, which are then validated against a trusted identity store. The question stem explicitly states "a user logs into a company's application using their username," implying that the initial identity verification (authentication) has already successfully occurred, and the subsequent step is about what the *authenticated* user is allowed to do.
When this WOULD be correct
A question that asks: 'A user provides their username and password to access a system. Which security concept does this step represent?' In that context, the correct answer would be authentication, as it verifies the user's identity.
- ✓
Authorization
Why this is correct
Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.
- ✗
Accounting
Why it's wrong here
Accounting, often referred to as auditing, is the process of systematically recording and reviewing user activities and system events. Its primary purpose is to create an immutable log of "who did what, when, and where," which is crucial for compliance, forensic analysis, and detecting anomalous behavior. This process occurs *after* a user has been authenticated and authorized to perform an action, focusing on logging the activity rather than determining access rights.
When this WOULD be correct
A question asks: 'An organization needs to track which users accessed sensitive data and when. Which security concept is primarily involved?' Here, accounting (auditing) would be correct as it logs user actions for review.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation is a security principle that guarantees a party cannot legitimately deny having performed a specific action or having sent a particular message. It is often achieved through cryptographic mechanisms like digital signatures, which provide irrefutable proof of origin and integrity, or through robust, tamper-proof audit trails. This concept focuses on accountability and proof of action *after* an event has occurred, rather than the initial decision-making process of granting or denying access based on permissions.
When this WOULD be correct
A question that asks: 'After a user performs a financial transaction, the system logs the transaction with a digital signature to prevent the user from denying they made it. Which security concept is this?' would have non-repudiation as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuthorizationCorrect answer▾
Why this is correct
Authorization is the process of granting or denying access to resources based on the authenticated user's permissions. The role check determines if the user is authorized to access the user management page, making this the correct answer.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
The role check occurs after the user has already logged in, meaning authentication (verifying identity via username/password) is complete. The check determines what the user is allowed to do, which is authorization, not authentication.
★ When this WOULD be the correct answer
A question that asks: 'A user provides their username and password to access a system. Which security concept does this step represent?' In that context, the correct answer would be authentication, as it verifies the user's identity.
Why candidates choose this
Candidates often confuse authentication and authorization because both involve user identity and access control, and the role check happens after login, making it seem like part of the authentication process.
✗AccountingWrong answer — click to see why▾
Why this is wrong here
Accounting refers to tracking user activities and resource usage (auditing), not to checking permissions after authentication. The role check determines access rights, which is authorization.
★ When this WOULD be the correct answer
A question asks: 'An organization needs to track which users accessed sensitive data and when. Which security concept is primarily involved?' Here, accounting (auditing) would be correct as it logs user actions for review.
Why candidates choose this
Candidates may confuse 'accounting' with 'authorization' because both involve user identity and access, but accounting is about logging and monitoring, not permission checks.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that a user cannot deny having performed an action, typically through digital signatures or audit logs. The role check in this question determines access rights based on identity, not proof of action.
★ When this WOULD be the correct answer
A question that asks: 'After a user performs a financial transaction, the system logs the transaction with a digital signature to prevent the user from denying they made it. Which security concept is this?' would have non-repudiation as the correct answer.
Why candidates choose this
Candidates may confuse non-repudiation with authorization because both involve verifying user identity, but non-repudiation focuses on accountability for actions rather than access control.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.