CISSP Security and Risk Management Practice Question
An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Encryption of data at rest protects against unauthorized access, thus ensuring confidentiality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Integrity
Why it's wrong here
Encryption's fundamental purpose is to render data unintelligible to unauthorized parties, thereby protecting its secrecy. While advanced encryption modes, such as Authenticated Encryption with Associated Data (AEAD) like AES-GCM, can provide integrity checks alongside confidentiality, simple encryption alone does not guarantee that data has not been tampered with. An attacker could alter encrypted data (ciphertext), and without a separate integrity mechanism like a Message Authentication Code (MAC) or digital signature, the recipient might decrypt corrupted data without detection.
- ✓
Confidentiality
Why this is correct
Encryption directly addresses confidentiality by transforming plaintext data into an unreadable ciphertext using a cryptographic algorithm and a secret key. This process ensures that even if unauthorized individuals gain access to the encrypted data, they cannot decipher its content without the correct decryption key. Consequently, encryption effectively prevents unauthorized disclosure of sensitive information, making it the primary control for upholding the confidentiality of data both at rest and in transit.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can access information and systems reliably and promptly when needed. Encryption, while vital for data protection, does not inherently contribute to availability; rather, its misapplication or failure can impede access. For instance, lost encryption keys or corrupted encrypted volumes can render data permanently inaccessible. Availability is primarily achieved through redundant systems, robust backup and recovery strategies, and fault-tolerant architectures, which are distinct from cryptographic transformations.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides undeniable proof of an action's origin or integrity, preventing an entity from falsely denying having performed it. While cryptographic techniques are foundational to non-repudiation, simple data encryption primarily focuses on obscuring content. Non-repudiation typically relies on digital signatures, which use a sender's private key to sign data, allowing recipients to verify the sender's identity and the data's integrity using the corresponding public key, thereby establishing an undeniable link to the originator.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Policy
A policy is a set of rules or guidelines that defines how an organization manages, secures, and operates its IT systems and services.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.