ISC2 CC Security Principles Practice Question
A security analyst is reviewing a log that shows an unauthorized user attempted to modify a payroll database. Which security principle is most directly threatened?
⚠ Common exam trap
Candidates often confuse integrity with confidentiality or non-repudiation, as candidates may focus on the 'unauthorized user' aspect and think of access control (confidentiality) rather than the modification attempt.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrity
Integrity ensures that data remains accurate, complete, and unaltered unless modified by authorized parties. The unauthorized attempt to modify the payroll database directly threatens this principle because it aims to change data without permission, compromising its trustworthiness. Confidentiality, non-repudiation, and availability are not the primary concerns here, as the focus is on unauthorized modification, not disclosure, proof of origin, or access disruption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Confidentiality
Why it's wrong here
Confidentiality protects data from unauthorised disclosure, whereas the log shows an attempted modification, which threatens integrity. Confidentiality is tempting because payroll data is sensitive and unauthorised access often precedes disclosure, but the specific action recorded is alteration, not exposure.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation ensures a party cannot deny performing an action, typically via signatures or audit trails; it does not describe the state of data being protected. It is tempting because logs prove actions occurred, but the threat here is unauthorised alteration, which is an integrity concern.
- ✓
Integrity
Why this is correct
Modifying a payroll database alters stored data, so its accuracy and trustworthiness are directly threatened. Integrity guarantees data remains unaltered by unauthorised parties; confidentiality concerns disclosure and availability concerns access, neither of which the modification attempt targets.
- ✗
Availability
Why it's wrong here
Availability concerns ensuring systems and data remain accessible to authorised users; the log records an attempted modification, not disruption of access. Availability is tempting when denial-of-service or ransomware is suspected, but no outage or destruction is described here.
Go deeper
Related to this question
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
User
A user is any person, system, or device that interacts with an IT service, resource, or identity system, typically authenticated through credentials and authorized to perform specific actions.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.