hardMultiple Choice
ISC2 CC Practice Question: A company's security policy states that sensitive…
A company's security policy states that sensitive data must be encrypted using AES-256. During an audit, it is found that some data is encrypted with AES-128. Which security objective is most directly compromised?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
AES-256 offers a higher security margin than AES-128. Using weaker encryption (AES-128) directly reduces the confidentiality protection, making it easier for an attacker to decrypt the data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Integrity
Why it's wrong here
Integrity concerns unauthorised alteration of data, whereas AES-128 still protects confidentiality; the weakness is cryptographic strength, not tamper detection. It is tempting because encryption is often bundled with hashing and MACs, so integrity is loosely associated with crypto controls, but the policy breach here is cipher strength.
- ✗
Availability
Why it's wrong here
Availability concerns timely, reliable access to data and systems; AES-128 does not restrict access or cause outages. It is tempting because encryption key management failures can render data unreadable, so availability is loosely linked to crypto, but the audit finding is a weaker cipher, not an access disruption.
- ✓
Confidentiality
Why this is correct
AES-128 still provides confidentiality, but the policy mandates AES-256 specifically. The compromised objective is compliance with the stated cryptographic standard, not confidentiality itself. Since the question asks which security objective is most directly affected, weaker-than-mandated encryption weakens the assurance level the policy requires, making confidentiality the closest fit.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation requires cryptographic proof of origin, typically via digital signatures, which symmetric AES encryption does not provide at all. It is tempting because both are cryptographic concepts, so the terms sit close together, but the finding concerns cipher strength for confidentiality, not proof of who sent data.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.