hardMultiple ChoiceObjective-mapped
ISC2 CC Practice Question: A security architect is evaluating a biometric…
A security architect is evaluating a biometric authentication system. The system's false positive rate is 0.1%, and the false negative rate is 2%. Which security principle is most compromised if the organization prioritizes user convenience over security?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
When the organization prioritizes user convenience over security, they may lower the biometric system's threshold to reduce false negatives (improving availability by letting more legitimate users in). However, this increases the false positive rate, allowing unauthorized users to be authenticated. This directly compromises confidentiality, as unauthorized access to systems and data can occur. Availability is initially improved (not compromised) by this action, so it is not the principle most compromised. Therefore, the correct answer is A (Confidentiality).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confidentiality
Why this is correct
Prioritizing convenience often involves lowering security thresholds to reduce false negatives, which increases false positives. This leads to unauthorized users gaining access, directly breaking confidentiality.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation is about ensuring that actions cannot be denied. Biometric systems can support non-repudiation, but adjusting thresholds for convenience does not primarily affect this principle.
- ✗
Availability
Why it's wrong here
Availability is actually improved by reducing false negatives (more legitimate users can access the system). Therefore, it is not compromised; rather, it is enhanced at the expense of confidentiality.
- ✗
Integrity
Why it's wrong here
Integrity involves ensuring data is not modified by unauthorized parties. While a higher false positive rate could lead to integrity violations, the most direct and immediate impact of increased false positives is on confidentiality.
Go deeper
Related to this question
Learn chapter
Introduction to Security Principles
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
Organization
An Organization is a top-level container in Google Cloud that represents your company or entities and serves as the root node for all your cloud resources, policies, and access control.
About these practice questions
This CC question is part of Courseiva's 976-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.