CISSP Security and Risk Management Practice Question
Which of the following is the primary purpose of the CIA triad in information security?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
To define the core objectives of information security
The CIA triad—Confidentiality, Integrity, and Availability—provides a foundational model for developing security policies and ensuring that data is protected from unauthorized access, tampering, and downtime.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
To establish a framework for risk management
Why it's wrong here
The CIA triad articulates the fundamental properties of secure information, which are then addressed by risk management processes. Risk management encompasses identifying threats, vulnerabilities, and impacts, and then selecting controls to protect confidentiality, integrity, and availability, making the triad a critical input rather than the overarching framework itself.
- ✗
To ensure compliance with regulatory requirements
Why it's wrong here
While regulatory requirements frequently mandate the implementation of controls designed to uphold confidentiality, integrity, and availability, the CIA triad's inherent purpose is not to ensure compliance. Instead, it serves as the conceptual foundation for what security aims to achieve, with compliance being an external driver for why certain security measures are adopted.
- ✗
To balance security controls with usability
Why it's wrong here
Balancing security controls with usability is a crucial design and implementation challenge within information security, often requiring trade-offs. However, this practical consideration is a consequence of applying security principles, not the primary definitional purpose of the CIA triad itself. The triad defines the core security objectives, not the operational complexities of achieving them.
- ✓
To define the core objectives of information security
Why this is correct
The CIA triad fundamentally defines the three paramount objectives that information security strives to achieve: Confidentiality, Integrity, and Availability. This foundational model provides a universal language and framework for understanding, categorizing, and prioritizing security goals across all aspects of information systems and data protection.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.