SC-900 Practice Question: Describe the concepts of security, compliance, and identity
A user receives an encrypted email from their bank. They use their private key to decrypt the message. After reading it, they verify that the message content has not been altered during transit. Which security principle is primarily demonstrated by the verification that the content was not altered?
⚠ Common exam trap
Many exam-takers confuse integrity with non-repudiation, but non-repudiation proves the origin of the message (who sent it), whereas integrity proves the message was not altered—two distinct security goals.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrity
The verification that the message content has not been altered during transit directly demonstrates the principle of integrity. Integrity ensures that data remains unchanged from its source to its destination, typically enforced through cryptographic hashing or digital signatures. In this scenario, the user's ability to confirm that the email content was not tampered with relies on a hash or signature verification mechanism, which is the core function of integrity protection.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality protects information from unauthorized disclosure, ensuring that only authorized individuals can access or read sensitive data. While the email being encrypted inherently provides confidentiality by preventing unauthorized parties from reading its content, the specific action described is the user *verifying* that the message content has not been *altered*. This verification process directly addresses integrity, even though confidentiality is also present due to encryption.
When this WOULD be correct
A question: 'Which security principle ensures that an encrypted email cannot be read by unauthorized parties?' would make confidentiality correct.
- ✓
Integrity
Why this is correct
Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can access information and systems when needed, without undue delay or interruption. The scenario describes a user successfully receiving and interacting with an email, indicating that the email service and the message itself were available. The act of verifying the message's content for alteration does not relate to the accessibility or uptime of the system or data, but rather to its trustworthiness.
When this WOULD be correct
A scenario where a user cannot access their encrypted email due to a server outage or denial-of-service attack would test availability. The question would ask: 'Which security principle is compromised when users cannot retrieve their emails?'
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides irrefutable proof of an action, preventing a sender from denying they sent a message or a recipient from denying they received it. While digital signatures can provide non-repudiation by linking a message to a specific sender, the scenario's focus is on verifying the *content's state* (unchanged), not on proving the sender's identity or preventing their denial of sending the email. Therefore, verifying content alteration is distinct from non-repudiation.
When this WOULD be correct
A user receives a digitally signed email from their bank. After verifying the signature, they can prove to a third party that the bank indeed sent the email. Which security principle does this proof demonstrate?
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓IntegrityCorrect answer▾
Why this is correct
Integrity ensures that data remains unaltered and complete during transmission or storage. When a user verifies that the content of an encrypted email from their bank has not been changed, they are confirming its integrity. This is typically achieved through cryptographic mechanisms like hashing or digital signatures, which detect any unauthorized modification, ensuring the message received is exactly what was sent.
✗ConfidentialityWrong answer — click to see why▾
Why this is wrong here
The question asks about verifying that content was not altered, which is integrity. Confidentiality protects data from unauthorized access, not from modification.
★ When this WOULD be the correct answer
A question: 'Which security principle ensures that an encrypted email cannot be read by unauthorized parties?' would make confidentiality correct.
Why candidates choose this
Candidates may confuse encryption (which provides confidentiality) with integrity verification, thinking that because the email was encrypted, the verification step also relates to confidentiality.
✗AvailabilityWrong answer — click to see why▾
Why this is wrong here
The question asks about verifying that message content was not altered, which is the definition of integrity. Availability concerns ensuring data is accessible when needed, not verifying content integrity.
★ When this WOULD be the correct answer
A scenario where a user cannot access their encrypted email due to a server outage or denial-of-service attack would test availability. The question would ask: 'Which security principle is compromised when users cannot retrieve their emails?'
Why candidates choose this
Candidates may confuse availability with integrity because both are part of the CIA triad, and they might think that verifying content is about ensuring the message is 'available' in its original form.
✗Non-repudiationWrong answer — click to see why▾
Why this is wrong here
Non-repudiation ensures that the sender cannot deny having sent the message, but the question focuses on verifying that the content was not altered, which is integrity.
★ When this WOULD be the correct answer
A user receives a digitally signed email from their bank. After verifying the signature, they can prove to a third party that the bank indeed sent the email. Which security principle does this proof demonstrate?
Why candidates choose this
Candidates may confuse integrity (content unchanged) with non-repudiation (undeniable origin), as both involve cryptographic verification and are often discussed together in security contexts.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
Courseiva writes every SC-900 question from scratch — 1,250 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.