CISSP Security and Risk Management Practice Question
An organization's security policy requires that all data at rest must be encrypted. Which security principle is primarily being addressed?
⚠ Common exam trap
CISSP often tests whether candidates correctly map controls to CIA triad principles; the trap is confusing encryption (confidentiality) with integrity or non-repudiation, especially when AEAD modes provide both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Confidentiality
Encryption of data at rest protects data from unauthorized disclosure by rendering it unreadable without the decryption key. This directly addresses the confidentiality principle of the CIA triad, ensuring only authorized parties can access the data. Integrity concerns unauthorized modification, availability concerns uptime, and non-repudiation concerns proving an action occurred.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Integrity
Why it's wrong here
Encryption's fundamental purpose is to render data unintelligible to unauthorized parties, thereby protecting its secrecy. While advanced encryption modes, such as Authenticated Encryption with Associated Data (AEAD) like AES-GCM, can provide integrity checks alongside confidentiality, simple encryption alone does not guarantee that data has not been tampered with. An attacker could alter encrypted data (ciphertext), and without a separate integrity mechanism like a Message Authentication Code (MAC) or digital signature, the recipient might decrypt corrupted data without detection.
- ✓
Confidentiality
Why this is correct
Encryption directly addresses confidentiality by transforming plaintext data into an unreadable ciphertext using a cryptographic algorithm and a secret key. This process ensures that even if unauthorized individuals gain access to the encrypted data, they cannot decipher its content without the correct decryption key. Consequently, encryption effectively prevents unauthorized disclosure of sensitive information, making it the primary control for upholding the confidentiality of data both at rest and in transit.
- ✗
Availability
Why it's wrong here
Availability ensures that authorized users can access information and systems reliably and promptly when needed. Encryption, while vital for data protection, does not inherently contribute to availability; rather, its misapplication or failure can impede access. For instance, lost encryption keys or corrupted encrypted volumes can render data permanently inaccessible. Availability is primarily achieved through redundant systems, robust backup and recovery strategies, and fault-tolerant architectures, which are distinct from cryptographic transformations.
- ✗
Non-repudiation
Why it's wrong here
Non-repudiation provides undeniable proof of an action's origin or integrity, preventing an entity from falsely denying having performed it. While cryptographic techniques are foundational to non-repudiation, simple data encryption primarily focuses on obscuring content. Non-repudiation typically relies on digital signatures, which use a sender's private key to sign data, allowing recipients to verify the sender's identity and the data's integrity using the corresponding public key, thereby establishing an undeniable link to the originator.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Security policy
A security policy is a formal set of rules and guidelines that an organization establishes to protect its information assets and technology resources.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.