CISSP Security and Risk Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Preventing unauthorized access to information

  Why this is correct

  Confidentiality's primary purpose is to safeguard sensitive information from unauthorized disclosure or access. This involves implementing controls such as encryption, robust access control mechanisms, and the principle of least privilege to ensure that only authorized individuals or systems can view or obtain specific data. Its core objective is to maintain the secrecy and privacy of information, preventing its exposure to those without a legitimate need-to-know.

• ✗

  Ensuring data is accurate and complete

  Why it's wrong here

  Ensuring data is accurate and complete directly addresses the principle of integrity, which focuses on maintaining the trustworthiness and reliability of information. Integrity controls aim to prevent unauthorized modification, alteration, or destruction of data, guaranteeing that the information remains uncorrupted and consistent throughout its lifecycle. This is distinct from confidentiality, which is concerned with preventing unauthorized disclosure rather than ensuring correctness.

• ✗

  Ensuring that users are who they claim to be

  Why it's wrong here

  The process of ensuring that users are who they claim to be is known as authentication, a critical step in establishing trust within a system. While authentication is a prerequisite for enforcing confidentiality by verifying identity before granting access, it is not the primary purpose of confidentiality itself. Confidentiality's goal is to protect the information's secrecy *after* a user's identity has been verified and their authorization determined.

• ✗

  Guaranteeing that systems are available when needed

  Why it's wrong here

  Guaranteeing that systems and information are accessible and usable by authorized users when needed is the core objective of availability. This principle focuses on ensuring uninterrupted access to resources, often through measures like redundancy, fault tolerance, and robust disaster recovery planning. Availability is fundamentally different from confidentiality, which is concerned with preventing unauthorized disclosure, not with the continuous operational status of systems.

Go deeper

Related to this question