SC-900 Authentication Practice Question
A user scans their fingerprint to unlock a corporate laptop. After unlocking, the user attempts to open a confidential database. The system checks the user's role and grants access because the user is a member of the 'Data Analyst' group. Which two security concepts are demonstrated in this scenario?
⚠ Common exam trap
Many candidates confuse 'identification' (claiming an identity, e.g., typing a username) with 'authentication' (proving that identity, e.g., fingerprint), and they may incorrectly select Option C because they see the fingerprint as identification rather than a proof factor.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication and authorization
The fingerprint scan demonstrates authentication, as the user proves their identity through a biometric factor. The subsequent role-based check of group membership ('Data Analyst') to grant database access demonstrates authorization. Therefore, only Option A (Authentication and authorization) is correct. Option B is incorrect because confidentiality and integrity are not demonstrated in this scenario: the scenario does not address data protection from unauthorized disclosure (confidentiality) or assurance that data is accurate and unmodified (integrity). The authorization check prevents unauthorized access, which is a component of access control but not a direct demonstration of confidentiality; integrity is not shown at all. Option C is incorrect because identification (claiming an identity) is not shown; the fingerprint is used for proof, not claim, and non-repudiation is not established. Option D is incorrect because availability of the database and accountability of user actions are not demonstrated.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication and authorization
Why this is correct
Correct. The fingerprint scan authenticates the user, and the role-based access check authorizes the user to open the database. These are the two security concepts demonstrated.
- ✗
Confidentiality and integrity
Why it's wrong here
Incorrect. While the scenario involves a confidential database, the concepts of confidentiality (preventing unauthorized disclosure) and integrity (ensuring data accuracy and no tampering) are not explicitly demonstrated. The access control mechanism ensures only authorized users can access the database, which is related to authorization, not a direct demonstration of confidentiality or integrity.
- ✗
Identification and non-repudiation
Why it's wrong here
Incorrect. Identification refers to claiming an identity (e.g., providing a username), which is not shown here; the fingerprint is used for authentication (proof). Non-repudiation is not established because there is no evidence to prevent the user from denying the action.
- ✗
Availability and accountability
Why it's wrong here
Incorrect. Availability of the database is not tested or demonstrated, and accountability (tracking user actions) is not shown in this scenario.
Go deeper
Related to this question
Learn chapter
Core Security Concepts
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.