General Security Concepts practice questions

Integrity means data is accurate and has not been altered without authorization.

The attacker changed values in the file. Nothing was disclosed (confidentiality) and nothing became unreachable (availability). Non-repudiation would help identify who made a change, but the property damaged by the change itself is integrity.

1. Identify what happened to the data: it was modified.
2. Check disclosure: none, so not confidentiality.
3. Check access: still available, so not availability.
4. Unauthorized modification maps to integrity.

Exam tip: Changed data = integrity; disclosed data = confidentiality; unreachable data = availability.

Availability is the assurance that authorized users can reach data and systems when they need them; ransomware that only encrypts data primarily attacks availability.

The stem removes the other two CIA properties on purpose: no exfiltration rules out confidentiality, and backups that match exactly show the records were not falsified. What remains is that staff could not use their files, which is an availability failure. Ransomware that also steals data (double extortion) would add a confidentiality impact.

1. Note the effect on users: they cannot open their files.
2. Use the stem's clues: no exfiltration, no falsified records.
3. Loss of access maps to availability.
4. Remember that double-extortion ransomware would add confidentiality.

Exam tip: Encryption-only ransomware is an availability attack; data theft adds confidentiality.

Confidentiality controls prevent unauthorized disclosure; encryption of stored data is the standard example.

Only encryption makes the data unreadable to someone who obtains it. Hashes and signatures are often confused with encryption because all three use cryptography, but they prove integrity and origin while leaving the content readable. Mirroring is an availability control.

1. Ask what each control stops: reading, altering or losing access.
2. Encryption stops reading, which is confidentiality.
3. Hashes and signatures detect alteration and prove origin.
4. Mirroring keeps data available.

Exam tip: Encryption hides data; hashes and signatures prove it is unchanged.

Authorization determines what an authenticated subject is allowed to access or do.

The sequence is identification (claim), authentication (prove), authorization (permit or deny), accounting (record). Because the sign-in with two factors succeeded, the denial at the share is an authorization decision. Accounting may log that denial, but it does not make it.

1. Place the event in the AAA sequence.
2. Sign-in succeeded, so authentication is done.
3. A resource-level 'no' is an authorization decision.
4. Accounting records the event; it does not decide.

Exam tip: Who are you = authentication; what may you do = authorization; what did you do = accounting.

Accounting tracks what authenticated users do: when they connect, for how long and what they use.

RADIUS provides all three AAA functions, which makes the other two tempting. The stem describes only record-keeping of usage after access is granted, which is accounting. Non-repudiation is a stronger property built on proof of who acted, not usage statistics.

1. Look at what the server does: it records usage.
2. Usage records after access is granted are accounting.
3. Authentication and authorization happen before the session.

Exam tip: Session logs of who, when, how long and how much = accounting.

Non-repudiation provides proof that a specific person performed an action, so they cannot credibly deny it.

Only a digital signature binds the action to an individual's private key while also protecting the record from later change. Hashing is the tempting near-twin: it gives integrity but no identity. Encryption and mirroring address confidentiality and availability.

1. Identify the need: proof of who approved.
2. Ask which option binds an action to one person.
3. A digital signature uses a key only the signer holds.
4. Hashes, encryption and copies do not identify the signer.

Exam tip: Non-repudiation needs proof of origin: a digital signature, not just a hash.