CISSP Security and Risk Management Practice Question
Which of the following is the PRIMARY purpose of the confidentiality principle in the CIA triad?
⚠ Common exam trap
The trap is conflating confidentiality with authentication or integrity; candidates pick 'users are who they claim to be' because authentication feels security-related, but confidentiality is specifically about preventing unauthorized disclosure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Preventing unauthorized access to information
Confidentiality in the CIA triad ensures information is disclosed only to authorized parties, so its primary purpose is preventing unauthorized access to data. This is achieved through encryption, access controls, and classification. The other options describe integrity, authentication, and availability respectively.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Preventing unauthorized access to information
Why this is correct
Confidentiality's primary purpose is to safeguard sensitive information from unauthorized disclosure or access. This involves implementing controls such as encryption, robust access control mechanisms, and the principle of least privilege to ensure that only authorized individuals or systems can view or obtain specific data. Its core objective is to maintain the secrecy and privacy of information, preventing its exposure to those without a legitimate need-to-know.
- ✗
Ensuring data is accurate and complete
Why it's wrong here
Ensuring data is accurate and complete directly addresses the principle of integrity, which focuses on maintaining the trustworthiness and reliability of information. Integrity controls aim to prevent unauthorized modification, alteration, or destruction of data, guaranteeing that the information remains uncorrupted and consistent throughout its lifecycle. This is distinct from confidentiality, which is concerned with preventing unauthorized disclosure rather than ensuring correctness.
- ✗
Ensuring that users are who they claim to be
Why it's wrong here
The process of ensuring that users are who they claim to be is known as authentication, a critical step in establishing trust within a system. While authentication is a prerequisite for enforcing confidentiality by verifying identity before granting access, it is not the primary purpose of confidentiality itself. Confidentiality's goal is to protect the information's secrecy *after* a user's identity has been verified and their authorization determined.
- ✗
Guaranteeing that systems are available when needed
Why it's wrong here
Guaranteeing that systems and information are accessible and usable by authorized users when needed is the core objective of availability. This principle focuses on ensuring uninterrupted access to resources, often through measures like redundancy, fault tolerance, and robust disaster recovery planning. Availability is fundamentally different from confidentiality, which is concerned with preventing unauthorized disclosure, not with the continuous operational status of systems.
Go deeper
Related to this question
Learn chapter
Access Control Models and Mechanisms
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 816 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.