Match each security principle to the best description.
Drag a concept onto its matching description — or click a concept then click the description.
Preventing unauthorized disclosure of information.
Ensuring data is not altered without authorization.
Keeping systems and data accessible when needed.
Giving a user only the permissions required to do the job.
Limiting access to information that a person specifically needs for their role.
Answer choices
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Confidentiality: Restricts access to authorized users.
These pairings match the CIA triad plus additional principles: confidentiality restricts access, integrity prevents unauthorized changes, availability ensures uptime, non-repudiation provides proof of actions, authentication verifies identity, and authorization defines permissions.
Answer analysis
For each option: why learners choose it and why it is or isn't the right answer here.
Confidentiality: Restricts access to authorized users.
Why this is correct
Confidentiality ensures that data and systems are accessible only to those explicitly cleared to view them, often enforced through attribute-based access control and full-disk encryption. It protects against unauthorized disclosure, whether accidental or malicious, by applying the principle of least privilege across users and processes. This is distinct from integrity because it focuses on secrecy rather than accuracy.
Integrity: Prevents unauthorized modification of data.
Why this is correct
Integrity guarantees that data remains unaltered from its original state except by sanctioned modifications, typically verified using cryptographic hash functions or digital signatures. It defends against unauthorized changes to files, messages, or configuration settings, preserving trust in the information's accuracy and completeness. Unlike availability, which concerns uptime, integrity is specifically about preserving the exactness of content.
Availability: Ensures systems are accessible when needed.
Why this is correct
Availability ensures that authorized users have timely and uninterrupted access to information and IT resources, often achieved through redundant infrastructure, load balancing, and backup recovery plans. It mitigates risks such as denial-of-service attacks, hardware failures, or power outages by implementing failover mechanisms and disaster recovery procedures. Security teams must balance availability with confidentiality and integrity, as reducing access controls can boost uptime but weaken protection.
Non-repudiation: Ensures data is unchanged.
Why it's wrong here
The claim that non-repudiation ensures data is unchanged actually describes integrity, not non-repudiation. Non-repudiation instead provides irrefutable proof of the origin or delivery of a message, commonly via PKI digital signatures or audit logs, so a party cannot deny their involvement. While integrity focuses on content preservation, non-repudiation focuses on accountability for the sending or receiving action itself.
Authentication: Grants permissions.
Why it's wrong here
Granting permissions is the role of authorization, not authentication. Authentication verifies a claimed identity by evaluating factors such as passwords, biometrics, or smart cards; it answers "Who are you?" It is a prerequisite for authorization but does not itself decide what resources or actions that identity may access.
Authorization: Verifies identity.
Why it's wrong here
Verifying identity is the function of authentication, not authorization. Authorization determines what permitted actions or resources an already authenticated user can access, using rules like role-based access control or access control lists. For example, after login (authentication), an admin may be authorized to modify files while a viewer can only read them.
Go deeper
Learn chapter
Security Controls
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Confidentiality Integrity and Availability
The CIA Triad is a foundational security model that ensures data is kept secret, unaltered, and accessible when needed.
About these practice questions
Courseiva writes every SY0-701 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SY0-701 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SY0-701 exam.