SC-900 Practice Question: Describe the concepts of security, compliance, and identity
An organization stores sensitive customer data in a cloud database. The security team uses encryption to protect the data while it is stored and while it is transmitted. They also implement role-based access control to ensure only authorized users can modify the data. Which two security principles are primarily being upheld by these actions?
⚠ Common exam trap
The trap is that candidates may incorrectly believe that encryption and RBAC also ensure availability. However, availability requires redundancy, fault tolerance, and uptime measures, which are not implemented here. The correct principles are confidentiality and integrity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality and integrity
Encryption at rest and in transit directly protects confidentiality by preventing unauthorized access to sensitive data. Role-based access control (RBAC) ensures only authorized users can modify data, which upholds integrity by preventing unauthorized or accidental changes. Availability, which concerns system uptime and accessibility, is not primarily addressed by these measures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Availability and integrity
Why it's wrong here
Incorrect. Availability and integrity are not both upheld; availability is not addressed by encryption and RBAC.
When this WOULD be correct
A scenario where the organization implements redundant servers and backup systems to ensure data is always accessible, and uses checksums to detect unauthorized changes. The question would ask which principles are upheld by those actions, making availability and integrity correct.
- ✓
Confidentiality and integrity
Why this is correct
Correct. Encryption protects confidentiality, and RBAC protects integrity by controlling modifications.
- ✗
Confidentiality and availability
Why it's wrong here
Incorrect. While confidentiality is upheld, availability is not a primary principle addressed here.
- ✗
Privacy and accountability
Why it's wrong here
Incorrect. Privacy is related to confidentiality but is not a core security principle in the CIA triad; accountability is not directly upheld by the described controls.
When this WOULD be correct
This option would be correct in a scenario where the organization implements data anonymization and consent management (privacy) along with audit trails and non-repudiation controls (accountability), such as when complying with GDPR requirements for personal data protection.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SC-900 exam frequently reuses these exact scenarios with slightly different constraints.
✓Confidentiality and integrityCorrect answer▾
Why this is correct
Correct. Encryption protects confidentiality, and RBAC protects integrity by controlling modifications.
✗Availability and integrityWrong answer — click to see why▾
Why this is wrong here
Encryption protects confidentiality and integrity, while RBAC ensures only authorized users can modify data, which also supports integrity. Availability is not directly addressed by these actions; encryption and RBAC do not guarantee data is accessible when needed.
★ When this WOULD be the correct answer
A scenario where the organization implements redundant servers and backup systems to ensure data is always accessible, and uses checksums to detect unauthorized changes. The question would ask which principles are upheld by those actions, making availability and integrity correct.
Why candidates choose this
Candidates may confuse encryption with availability or think that protecting data from unauthorized access also ensures it is always available, overlooking that availability requires separate measures like redundancy and disaster recovery.
✗Privacy and accountabilityWrong answer — click to see why▾
Why this is wrong here
The actions described (encryption at rest and in transit, RBAC) primarily protect confidentiality and integrity, not privacy and accountability. Privacy is broader and involves data handling policies, while accountability requires audit logs and non-repudiation mechanisms not mentioned here.
★ When this WOULD be the correct answer
This option would be correct in a scenario where the organization implements data anonymization and consent management (privacy) along with audit trails and non-repudiation controls (accountability), such as when complying with GDPR requirements for personal data protection.
Why candidates choose this
Candidates may confuse encryption and access controls with privacy (since they protect sensitive data) and accountability (since RBAC can be seen as assigning responsibility), but these principles are distinct from the specific technical controls described.
Analysis generated from the official SC-900blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
Learn chapter
Microsoft Entra Global Secure Access
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
About these practice questions
This SC-900 question is part of Courseiva's 1,279-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.