SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user logs into a corporate laptop by inserting a smart card and entering a PIN. The user then attempts to open a confidential folder. The operating system checks the user's access rights and denies access. Which security concepts are demonstrated in this scenario?
⚠ Common exam trap
Many exam-takers confuse 'identification' with 'authentication' — the smart card + PIN is a multi-factor authentication process, not merely identification, and the access check is authorization, not accounting or identification.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication and authorization
The scenario demonstrates authentication (verifying the user's identity via smart card + PIN) and authorization (the OS checking access rights and denying access to the folder). Authentication confirms who the user is, while authorization determines what resources they can access. Option B correctly pairs these two concepts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Identification and authorization
Why it's wrong here
This option is incorrect because 'identification' refers to the act of a user claiming an identity (e.g., providing a username), whereas the scenario explicitly describes the use of a smart card and PIN to *prove* that identity. Proving an identity is the definition of authentication, which is a more robust process than mere identification. While authorization is a part of the scenario, the initial action described is authentication, not just identification.
- ✓
Authentication and authorization
Why this is correct
This option is correct because the user's insertion of a smart card and input of a PIN constitute a multi-factor authentication process, verifying their claimed identity. Following successful authentication, the operating system then performs an authorization check, determining whether the authenticated user has the necessary permissions to access the requested folder. The denial of access clearly demonstrates an authorization decision based on established access controls.
- ✗
Authentication and accounting
Why it's wrong here
This option is incorrect because 'accounting' refers to the process of tracking user activities, resource consumption, and system events for auditing, billing, or capacity planning purposes. While authentication is certainly present in the scenario, there is no mention of logging user actions, monitoring resource usage, or generating audit trails, which are the core functions of accounting. The scenario focuses on establishing identity and controlling access, not on activity tracking.
- ✗
Identification and authentication
Why it's wrong here
This option is incorrect because while both identification (claiming an identity) and authentication (proving that identity via smart card and PIN) are integral parts of the login process, the scenario explicitly extends beyond just proving identity. The subsequent denial of access to a folder is a clear example of an authorization decision being made by the system. Therefore, an option that omits authorization fails to fully describe all the security concepts demonstrated in the given scenario.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Folder
A folder is a logical container used to organize and group digital files, resources, or cloud-based assets within a system or platform.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.