ISC2 CC Security Principles Practice Question
An organization is developing a security policy. Which TWO of the following are core components of the CIA triad?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
The CIA triad consists of Confidentiality, Integrity, and Availability. Authentication and Non-repudiation are related but not part of the core triad.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Confidentiality
Why this is correct
Confidentiality ensures information is disclosed only to authorised parties, typically enforced through encryption, access controls and classification. It forms one of the three pillars the policy must address, directly satisfying the stem's requirement for a core CIA triad component.
- ✓
Integrity
Why this is correct
Integrity ensures data remains accurate and unaltered unless changed by authorised means, enforced via hashing, checksums and change controls. It is a foundational CIA triad pillar, satisfying the stem's requirement that the policy cover core security components.
- ✗
Authorization
Why it's wrong here
Authorization determines permitted actions after identity is established, so it is not one of the CIA triad's three properties. It is tempting because authorization enforces confidentiality and integrity in practise, but the triad names confidentiality, integrity and availability themselves, not the access-control functions built on them.
- ✗
Authentication
Why it's wrong here
Authentication verifies identity and sits outside the CIA triad, which comprises confidentiality, integrity and availability. It is tempting because authentication underpins access control and appears in most security policies, but it is a supporting mechanism, not one of the three core information-security properties.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation proves an action occurred and cannot be denied, which is an assurance property, not one of the CIA triad's three components: confidentiality, integrity and availability. It is tempting because it is a recognised security goal, and it would be the correct choice in a question about the Parkerian hexad or about digital signatures and audit evidence.
Go deeper
Related to this question
Learn chapter
Network Security Components and Controls
Key term
Confidentiality
Confidentiality means keeping sensitive information secret and accessible only to authorized people or systems.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 989 original CC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.