ISC2 CC Security Principles Practice Question

An organization implements encryption for data at rest and in transit. Which principle of the CIA triad is primarily being addressed?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Confidentiality

Encryption ensures data is not readable by unauthorized parties, thereby protecting confidentiality.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Non-repudiation
Why it's wrong here
Non-repudiation is not a CIA triad principle; it is a separate assurance proving a party performed an action, typically via digital signatures. Encryption alone cannot bind a sender to a message. It is tempting because encryption and signatures often appear together, but the stem asks which CIA principle encryption addresses, namely confidentiality.
✗
Availability
Why it's wrong here
Availability concerns uptime and access to data and systems, whereas encryption at rest and in transit protects confidentiality by preventing unauthorised disclosure. Availability is tempting because encryption supports overall security, but it would be the principle addressed by redundancy, backups, or DDoS resilience.
✗
Integrity
Why it's wrong here
Encryption conceals content, which serves confidentiality; it does not detect unauthorised modification, so integrity is not the principle addressed. Integrity is tempting because hashing and digital signatures also protect data, but those mechanisms verify that data has not been altered, whereas encryption's purpose here is preventing disclosure.
✓
Confidentiality
Why this is correct
Confidentiality ensures data is readable only by authorised parties. Encryption at rest protects stored data and encryption in transit protects data on the wire, so both controls prevent unauthorised disclosure — the specific CIA principle the organisation is addressing.

Go deeper