ISC2 CC Security Principles Practice Question
A security analyst is implementing controls to prevent unauthorized disclosure of sensitive information. Which element of the CIA triad is being addressed?
⚠ Common exam trap
A common mix-up: candidates confuse confidentiality with integrity or availability, especially when the question mentions 'controls' without specifying encryption or access controls; candidates might incorrectly associate 'prevent unauthorized disclosure' with integrity if they misread 'disclosure' as 'modification'.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Confidentiality is the element of the CIA triad that ensures information is not disclosed to unauthorized individuals, entities, or processes. The scenario explicitly states the goal is to prevent unauthorized disclosure of sensitive information, which is the definition of confidentiality. Controls such as encryption, access control lists, and data classification directly support confidentiality. Therefore, option D is correct.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation proves that a party performed an action, typically through digital signatures or audit logs, so it addresses deniability rather than disclosure. It is tempting because it is often listed alongside the CIA triad in security frameworks, and non-repudiation would be correct if the scenario required proving who sent or approved a transaction.
- ✗
Integrity
Why it's wrong here
Integrity guards data against unauthorised modification, so it addresses tampering, not disclosure. It is tempting because integrity controls such as hashing and digital signatures are frequently deployed alongside confidentiality measures, and integrity would be the correct answer if the scenario described altered or corrupted records rather than exposed ones.
- ✗
Availability
Why it's wrong here
Availability ensures data and services remain accessible to authorised users, so it addresses disruption, not disclosure. It is tempting because availability controls such as redundancy and backups are commonly implemented in the same programmes as confidentiality controls, and availability would be correct if the scenario described denial of service or downtime rather than exposure.
- ✓
Confidentiality
Why this is correct
Confidentiality directly addresses preventing unauthorised disclosure, which is the exact control objective stated in the stem. Encryption, access controls and data classification enforce confidentiality by restricting data access to authorised parties only. Integrity would concern unauthorised modification, and availability would concern timely access, neither of which matches the disclosure constraint.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every CC question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.