easyMultiple Choice
ISC2 CC Practice Question: A company requires employees to use biometric…
A company requires employees to use biometric authentication to access the data center. This is an example of which security principle?
⚠ Common exam trap
It's easy for candidates to confuse authentication (proving identity) with non-repudiation (proving an action occurred and cannot be denied) — biometrics are often cited in both contexts, but the question asks about the act of verifying identity, which is authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authentication
Biometric authentication (fingerprint, retina, facial recognition) verifies a claimed identity by matching a unique physical trait against a stored template, which is the definition of authentication — proving you are who you say you are. It falls under the 'something you are' authentication factor. The other options describe different security goals (availability, integrity, non-repudiation) rather than the act of verifying identity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Authentication
Why this is correct
Biometric traits such as fingerprints or iris patterns verify a claimed identity, so the mechanism maps directly to authentication — proving who the user is. It satisfies the stem's requirement for identity verification before data centre access, distinct from authorisation, which governs what that verified identity may then do.
- ✗
Availability
Why it's wrong here
Availability ensures systems and data remain accessible to authorised users, which biometric access control does not itself provide. It appeals because a working door reader keeps the data centre reachable, yet the scenario's requirement is proving identity, the authentication principle, not uptime or resilience.
- ✗
Integrity
Why it's wrong here
Integrity guards data against unauthorised modification, so it does not describe verifying a person's identity at a door. It is tempting because integrity controls often accompany authentication in layered physical security, but the biometric check itself establishes who the employee is, which is the authentication principle.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation uses cryptographic evidence to prevent someone denying an action, such as a signed transaction. It attracts because biometrics are unique per person, but a fingerprint scan at a door grants access rather than binding a party to a later-disputed action, so authentication is the principle demonstrated.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
Non-repudiation
Non-repudiation is a security principle that ensures a party in a digital transaction cannot deny their involvement or the authenticity of their digital signature.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.