Security Principles practice questions

Security controls map to CIA triad goals. Encryption is the classic confidentiality control because it renders data unreadable to anyone without the correct key.

Encrypting data at rest means that even if the database file is stolen or accessed by an unauthorized person, its contents remain unreadable. That is a protection against unauthorized disclosure, which is confidentiality. It does not keep the server online, log activity, or grant permissions.

1. Identify what the control does: encryption makes data unreadable without a key.
2. Ask which CIA goal is served when unauthorized people cannot read data.
3. Preventing unauthorized disclosure is confidentiality.
4. Confirm the distractors map elsewhere: backups map to availability, logs map to accounting, permissions map to authorization.

Exam tip: On the exam, map encryption to confidentiality, hashing to integrity, and backups or redundancy to availability.

Integrity means information is accurate, complete, and trustworthy, and that any unauthorized change can be prevented or detected.

The defining property of integrity is protection against unauthorized modification. Confidentiality covers secrecy, availability covers access when needed, and non-repudiation covers proof of actions, so only the accuracy-and-no-tampering statement fits.

1. Recall the one-line definitions of confidentiality, integrity, and availability.
2. Integrity focuses on the trustworthiness and accuracy of data over its lifecycle.
3. Select the statement about accuracy and freedom from unauthorized modification.
4. Rule out secrecy (confidentiality), uptime (availability), and denial of actions (non-repudiation).

Exam tip: Integrity means data has not been tampered with; if information can be trusted as accurate and unaltered, integrity is intact.

A hash function produces a fixed-length fingerprint of data. If even one bit of the data changes, the hash changes, which makes hashing the standard tool for detecting unauthorized modification.

Comparing the computed hash with the vendor's published hash tells the administrator whether the file is byte-for-byte identical to the original. A match confirms the file has not been tampered with or corrupted, which is the definition of verifying integrity.

1. Identify the mechanism: computing and comparing hash values.
2. Recall that hashes change whenever the underlying data changes.
3. A matching hash therefore proves the data is unmodified, which is integrity.
4. Note that hashing does not encrypt the file, keep it available, or assign permissions.

Exam tip: Hashing detects change: matching hashes mean the data is intact, so hashing maps to integrity on the exam.

Privacy is the right of individuals to control the collection, use, retention, and sharing of information about themselves. Organizations that handle personal data must respect this right, often under laws and regulations.

The defining idea of privacy is individual control over personal information. Availability, accounting, and encryption are security concepts and controls; they may support or interact with privacy, but none of them defines it.

1. Distinguish privacy (a right of individuals over their personal data) from security (the protection mechanisms).
2. Look for the option centered on individual control of personal information.
3. Eliminate options describing availability, logging, and encryption, which are security concepts, not the definition of privacy.
4. Remember that security controls like encryption are often used to help uphold privacy obligations.

Exam tip: Privacy is about an individual's control over their personal information; security provides the controls that help protect that right.

Availability means authorized users have timely and reliable access to systems and data. Denial-of-service attacks are the classic attack against availability.

Flooding a server so legitimate customers cannot reach it denies access to an authorized audience. No data is disclosed and nothing is altered, so confidentiality and integrity are unaffected; the harm is entirely to availability.

1. Identify the effect of the attack: legitimate users cannot reach the service.
2. Map the effect to the CIA triad: blocked access equals lost availability.
3. Confirm nothing was disclosed (confidentiality intact) and nothing was changed (integrity intact).
4. Recognize denial-of-service as the standard example of an availability attack.

Exam tip: Denial-of-service attacks target availability; they block legitimate access without necessarily disclosing or altering data.

Ransomware makes data unusable by encrypting it and demanding payment for the key. Because authorized users are locked out of their own data, ransomware is taught as an attack on availability.

The scenario's impact is that staff cannot retrieve patient charts, meaning authorized users are denied timely access to data. That is the definition of an availability loss. Some ransomware also steals data, which would add a confidentiality impact, but the primary and described effect is denied access.

1. Read the impact stated in the scenario: staff cannot retrieve patient charts.
2. Denied access for authorized users maps to availability.
3. Note that ransomware uses encryption as a weapon against the owner rather than as a protective control.
4. Recall the standard mappings: ransomware and denial-of-service map to availability.

Exam tip: Ransomware locks authorized users out of their own data, making it primarily an availability attack; backups are the key recovery control.