ISC2 CC Security Principles Practice Question
An organization encrypts all sensitive data at rest and in transit. Which principle of the CIA triad is primarily being addressed?
⚠ Common exam trap
Watch out — candidates often confuse confidentiality with integrity because encryption is sometimes described as 'protecting' data — candidates who do not distinguish between preventing unauthorized reading (confidentiality) and preventing unauthorized modification (integrity) may select the wrong principle.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Encryption of data at rest and in transit directly protects data from unauthorized disclosure, which is the definition of confidentiality in the CIA triad. Encryption ensures that even if data is intercepted or accessed without authorization, it remains unreadable without the proper decryption key. This is the textbook control for the confidentiality principle.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Availability
Why it's wrong here
Availability ensures systems and data remain accessible to authorised users, achieved through redundancy, backups and failover; encryption addresses confidentiality instead. It is tempting because encrypted data must still be decryptable when needed, but availability would be the answer if the stem described outages, denial of service or resilience requirements rather than protecting sensitive data.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation proves a party performed an action, typically via digital signatures and audit trails, so it does not describe encryption of stored or transmitted data. It is tempting because encryption and signing both use keys, but non-repudiation would be the answer when the requirement is proving who sent or authorised data.
- ✗
Integrity
Why it's wrong here
Integrity assures data is unaltered, verified through hashes, checksums or signatures; encryption alone conceals content without detecting modification. It is tempting because encryption is often bundled with integrity controls, but integrity would be correct if the stem required detecting tampering rather than preventing disclosure of data at rest and in transit.
- ✓
Confidentiality
Why this is correct
Encryption at rest and in transit renders data unreadable to unauthorised parties, directly preventing disclosure. Confidentiality is the CIA principle concerned with restricting data access to approved subjects, so encrypting sensitive data satisfies that constraint rather than integrity or availability.
Go deeper
Related to this question
Learn chapter
Access Control Fundamentals
Key term
Confidentiality Integrity and Availability
The CIA Triad is a foundational security model that ensures data is kept secret, unaltered, and accessible when needed.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.