CISSP Security and Risk Management Practice Question
An organization is implementing a new access control system. The security team wants to ensure that users cannot deny having performed an action. Which security principle is being addressed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Non-repudiation
Non-repudiation ensures that a party cannot deny the authenticity of their signature or the sending of a message. In access control, this is often achieved through audit logs and digital signatures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can access information and resources when needed, preventing service disruptions and ensuring system uptime. While crucial for any operational system, it does not provide mechanisms to prove that a specific user performed a particular action, nor does it prevent a user from denying their involvement in an event. Its focus is on continuous operation and accessibility, not accountability for past deeds.
- ✗
Integrity
Why it's wrong here
Integrity focuses on safeguarding the accuracy, completeness, and consistency of data throughout its entire lifecycle. It prevents unauthorized modification or destruction of information, ensuring its trustworthiness and reliability. However, maintaining data integrity does not inherently provide irrefutable proof of who initiated a specific action, which is essential to counter a user's denial of having performed that action.
- ✗
Confidentiality
Why it's wrong here
Confidentiality is the principle of protecting sensitive information from unauthorized disclosure or access, ensuring that only authorized individuals can view specific data. It is vital for privacy and preventing data leaks, safeguarding information from being read by unintended parties. However, confidentiality does not address the issue of proving that a particular user executed a specific operation; its primary concern is secrecy, not the attribution of actions.
- ✓
Non-repudiation
Why this is correct
Non-repudiation provides irrefutable proof that a specific action or event has occurred and that a particular entity was responsible for it, preventing them from later denying their involvement. This is typically achieved through robust audit trails, digital signatures, and secure logging mechanisms that cryptographically link an action to a user. Therefore, it directly addresses the requirement to prevent users from disclaiming responsibility for their actions within an access control system.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Access control
Access control is the security practice of determining who or what is allowed to view, use, or enter a resource, and under what conditions.
Key term
Audit
An audit is a systematic, independent review of IT systems, processes, and controls to verify compliance with policies, standards, and regulations.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.