SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user logs into the company's network using their username and password. After successful login, the user attempts to open a financial report but receives an access denied message because they are not a member of the 'Finance' security group. Which security concept is best illustrated by the access denial?
⚠ Common exam trap
It's easy for candidates to confuse authentication (verifying identity) with authorization (granting permissions), leading candidates to select 'Authentication' because they focus on the successful login rather than the subsequent access denial.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorization
The access denial occurs because the user lacks the necessary permissions to open the financial report, even though their identity was verified. This is the core function of authorization, which determines what resources an authenticated user can access. In this scenario, the user is authenticated but not authorized to access the report due to missing group membership.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Authentication
Why it's wrong here
Authentication is the initial security step where a user or system proves their asserted identity, typically through credentials like usernames and passwords, biometrics, or certificates. Its sole purpose is to verify "who you are," confirming the legitimacy of the entity attempting to gain access. While essential for entry, authentication itself does not dictate what specific resources or actions that verified identity is allowed to perform once inside the system.
When this WOULD be correct
A question that asks: 'A user enters their username and password to log into a system. Which security concept is being applied?' would make authentication the correct answer.
- ✓
Authorization
Why this is correct
Authorization is the critical security process that determines what an authenticated user or system is permitted to do or access within a network or application. Following successful authentication, authorization mechanisms evaluate a user's assigned roles, group memberships, and specific permissions against the requested resource or action. If the user lacks the necessary privileges, access is explicitly denied, directly explaining why a logged-in user might be unable to access certain resources.
- ✗
Accounting
Why it's wrong here
Accounting, often referred to as auditing, involves systematically tracking and logging all user activities, resource consumption, and system events within a network or application. Its primary function is to create a comprehensive audit trail, enabling security administrators to review "what happened, when, and by whom." This data is crucial for forensic analysis, compliance reporting, and identifying potential security breaches, but it does not directly govern whether access is granted or denied in real-time.
When this WOULD be correct
A scenario where a user performs an action (e.g., modifies a file) and the system logs the user's identity and action to ensure accountability. The question would ask which concept ensures actions can be traced back to a specific user.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation is a security service designed to provide irrefutable proof that a specific action or event occurred and originated from a particular source. It prevents an entity from successfully denying responsibility for a past action, often achieved through digital signatures or cryptographic hashing that binds an action to an identity. This concept is distinct from access control, as it focuses on accountability and trustworthiness of past actions rather than real-time access decisions.
When this WOULD be correct
A user submits a purchase order using their digital certificate, but later claims they never submitted it. The system provides a signed audit trail proving the submission. This illustrates non-repudiation.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓AuthorizationCorrect answer▾
Why this is correct
Authorization is the critical security process that determines what an authenticated user or system is permitted to do or access within a network or application. Following successful authentication, authorization mechanisms evaluate a user's assigned roles, group memberships, and specific permissions against the requested resource or action. If the user lacks the necessary privileges, access is explicitly denied, directly explaining why a logged-in user might be unable to access certain resources.
✗AuthenticationWrong answer — click to see why▾
Why this is wrong here
Authentication verifies identity (who you are), but the access denial occurred after successful login, meaning identity was already confirmed. The denial is due to insufficient permissions, which is authorization.
★ When this WOULD be the correct answer
A question that asks: 'A user enters their username and password to log into a system. Which security concept is being applied?' would make authentication the correct answer.
Why candidates choose this
Candidates often confuse authentication and authorization because both involve access control and occur sequentially during login, leading them to mistakenly associate the access denial with the authentication step.
✗AccountingWrong answer — click to see why▾
Why this is wrong here
Accounting tracks user actions for auditing, not access control. The access denial is due to lack of permissions, which is authorization.
★ When this WOULD be the correct answer
A scenario where a user performs an action (e.g., modifies a file) and the system logs the user's identity and action to ensure accountability. The question would ask which concept ensures actions can be traced back to a specific user.
Why candidates choose this
Candidates may confuse accounting (auditing) with authorization because both involve permissions and access logs, but accounting focuses on recording events, not enforcing access.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that a user cannot deny having performed an action, typically through digital signatures or audit logs. The access denial here is about permissions, not about proving or denying actions.
★ When this WOULD be the correct answer
A user submits a purchase order using their digital certificate, but later claims they never submitted it. The system provides a signed audit trail proving the submission. This illustrates non-repudiation.
Why candidates choose this
Candidates may confuse authorization (permissions) with non-repudiation because both involve security controls, but non-repudiation focuses on accountability and proof of actions, not access rights.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Security group
A security group is a virtual firewall that controls inbound and outbound traffic to AWS resources, such as EC2 instances, based on defined rules.
About these practice questions
This SC-900 question is part of Courseiva's 1,250-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.