ISC2 CC Security Principles Practice Question
A hospital's IT department wants to ensure that only authorized clinicians can view patient records, while also guaranteeing that those records have not been tampered with. Which security principle is primarily concerned with preventing unauthorized disclosure of the records?
⚠ Common exam trap
Candidates often confuse confidentiality with integrity because the scenario also mentions tampering, but the question specifically asks about preventing unauthorized disclosure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Confidentiality is the security principle that ensures information is not made available or disclosed to unauthorized individuals, entities, or processes. In the hospital scenario, the goal is to restrict patient record access to authorized clinicians, which is a classic confidentiality objective. Integrity addresses unauthorized modification, availability addresses timely access, and non-repudiation addresses proof of actions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides proof of the origin and integrity of data, preventing a party from denying having performed an action. It does not directly prevent unauthorized disclosure of patient records. While non-repudiation supports accountability, the primary principle for preventing unauthorized viewing is confidentiality, not non-repudiation.
- ✗
Integrity
Why it's wrong here
Integrity ensures data is accurate and complete and has not been altered improperly. While the scenario mentions guaranteeing records have not been tampered with, that is a separate goal from preventing unauthorized disclosure. The question asks specifically about preventing unauthorized disclosure, so integrity does not address the primary concern described.
- ✗
Availability
Why it's wrong here
Availability ensures that systems and data are accessible to authorized users when needed. The scenario focuses on restricting access to authorized clinicians and preventing disclosure, not on ensuring the records are accessible. Availability would be relevant if the concern were downtime or denial of service, which is not the case here.
- ✓
Confidentiality
Why this is correct
Confidentiality ensures that information is not disclosed to unauthorized individuals, entities, or processes. In this scenario, restricting patient record access to authorized clinicians directly addresses preventing unauthorized disclosure, which is the core goal of confidentiality. The integrity and availability aspects are separate concerns; the question specifically asks about preventing unauthorized disclosure, making confidentiality the correct principle.
Go deeper
Related to this question
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
Availability
Availability is the measure of how often a system or service is operational and accessible when needed, typically expressed as a percentage of uptime.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.