CPA Isc Quiz: Apply Information Security Principles Cia Triad
20 questions · exam conditions
0:00
Apply Information Security Principles Cia TriadQuestion 1 of 20

A company stores backup copies of all critical data in a geographically separate, secure facility. This control primarily supports which CIA triad principle?

Confidentiality - by keeping data in a location unknown to attackers.
Integrity - by maintaining an unaltered copy of data for comparison.
Authentication - by providing a secondary source for identity verification.
Availability - by ensuring data can be restored if the primary site is destroyed or compromised.
← Back to quizzes

CPA Isc Quiz

CPA Isc Quiz: Apply Information Security Principles Cia Triad

Practice Apply Information Security Principles Cia Triad in CPA Isc with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

What this quiz covers

This quiz focuses on Apply Information Security Principles Cia Triad, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

A company stores backup copies of all critical data in a geographically separate, secure facility. This control primarily supports which CIA triad principle?

  1. Confidentiality - by keeping data in a location unknown to attackers.
  2. Integrity - by maintaining an unaltered copy of data for comparison.
  3. Authentication - by providing a secondary source for identity verification.
  4. Availability - by ensuring data can be restored if the primary site is destroyed or compromised. (correct answer)

Explanation: Geographic backup storage ensures that critical data can be recovered and made available following a disaster at the primary site, directly supporting availability. Answer D is correct. While backups may have some integrity value (B), their primary purpose in a DR context is availability. Confidentiality (A) and authentication (C) are not the primary purposes of geographic backup storage.

Question 2

Which of the following controls most directly supports the confidentiality principle of the CIA triad?

  1. Redundant power supplies to prevent system downtime.
  2. Hash functions to verify that files have not been altered.
  3. Automated backup systems that run nightly.
  4. Encryption of sensitive data at rest and in transit. (correct answer)

Explanation: Encryption protects data from unauthorized disclosure by making it unreadable without the decryption key, directly supporting confidentiality. Answer D is correct. Redundant power supplies (A) support availability. Hash functions (B) support integrity. Backup systems (C) support availability.

Question 3

A hospital's electronic health record system experiences an unplanned outage during a critical care situation. This event primarily threatens which CIA triad principle?

  1. Availability (correct answer)
  2. Integrity
  3. Confidentiality
  4. Authorization

Explanation: System unavailability during critical need directly threatens the availability principle - the assurance that authorized users can access information when required. Answer A is correct. Integrity (B) and confidentiality (C) are not compromised by an outage alone. Authorization (D) is a control mechanism, not a CIA principle.

Question 4

A distributed denial-of-service (DDoS) attack floods a company's website with traffic, causing it to become unavailable to customers. Which CIA triad principle is primarily targeted by this attack?

  1. Confidentiality
  2. Integrity
  3. Authentication
  4. Availability (correct answer)

Explanation: A DDoS attack overwhelms systems to prevent legitimate users from accessing services, directly targeting availability. Answer D is correct. Confidentiality (A) and integrity (B) are not compromised by a DDoS attack. Authentication (C) is a control mechanism, not a CIA principle.

Question 5

A company implements an intrusion detection system (IDS) that monitors network traffic for suspicious activity and alerts the security team. This control primarily supports which CIA triad principle(s)?

  1. All three - it can detect attacks on confidentiality, integrity, and availability. (correct answer)
  2. Availability only, since IDS primarily prevents denial-of-service attacks.
  3. Integrity only, since IDS monitors data transmission accuracy.
  4. Confidentiality only, since IDS detects unauthorized access attempts.

Explanation: An IDS monitors for a wide range of attacks - unauthorized access (confidentiality), data modification (integrity), and service disruption (availability) - supporting all three CIA principles. Answer A is correct. Limiting IDS to one principle (B, C, or D) understates its broad security monitoring scope.

Question 6

A penetration tester successfully extracts a plaintext database file containing customer names, social security numbers, and financial account numbers. Which CIA triad principle has been violated?

  1. Availability
  2. Integrity
  3. Non-repudiation
  4. Confidentiality (correct answer)

Explanation: Extracting sensitive personal and financial data exposes it to an unauthorized party, violating confidentiality. Answer D is correct. Availability (A) and integrity (B) are not affected by read-only extraction. Non-repudiation (C) is not a CIA triad component.

Question 7

A company implements digital certificates to authenticate the identity of its web server to users. This control most directly supports which CIA triad principle?

  1. Availability
  2. Integrity
  3. Confidentiality (correct answer)
  4. Non-repudiation

Explanation: Digital certificates authenticate the server's identity and enable encrypted communication (TLS/SSL), preventing man-in-the-middle attacks that could expose data - primarily supporting confidentiality. Answer C is correct. Availability (A) is not the primary concern. While certificates also support integrity (B) and non-repudiation (D), their primary role in web server authentication is ensuring secure, confidential communication.

Question 8

An organization's auditor reviews controls over the financial reporting system and finds that journal entries can be posted and deleted without leaving an audit trail. Which CIA triad principle is most at risk?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Authentication

Explanation: The ability to post and delete transactions without audit trail creates risk that financial data can be manipulated without detection, directly threatening integrity - the accuracy and completeness of financial records. Answer B is correct. Availability (A) is not impacted by missing audit trails. Confidentiality (C) relates to unauthorized viewing. Authentication (D) relates to verifying identity.

Question 9

An organization implements role-based access controls (RBAC) to restrict employees from viewing payroll records unless they are in the HR department. This control primarily supports which CIA triad principle?

  1. Confidentiality (correct answer)
  2. Integrity
  3. Availability
  4. Accountability

Explanation: Restricting access to sensitive payroll data based on user roles prevents unauthorized disclosure, directly supporting confidentiality. Answer A is correct. Integrity (B) concerns data accuracy and modification. Availability (C) concerns access when needed. Accountability (D) is a related security concept but not a CIA triad component.

Question 10

A company classifies certain systems as 'mission-critical' and implements a recovery time objective (RTO) of four hours for these systems. This classification most directly supports which CIA triad principle?

  1. Availability - by defining how quickly critical systems must be restored to ensure access is maintained. (correct answer)
  2. Integrity - by establishing standards for data accuracy after recovery.
  3. Confidentiality - by limiting which systems can be accessed during recovery.
  4. Authentication - by verifying user identities after system restoration.

Explanation: RTOs define how quickly systems must be restored after a disruption, directly measuring and managing availability. Answer A is correct. Integrity (B), confidentiality (C), and authentication (D) are not the primary CIA concern addressed by RTO objectives.

Question 11

An organization discovers that an attacker gained access to its network and observed sensitive communications for 60 days without altering any data or disrupting any services. Which CIA triad principle was violated?

  1. Confidentiality - sensitive information was accessed and observed by an unauthorized party. (correct answer)
  2. Integrity - the attacker's presence in the network compromised data accuracy.
  3. Availability - the attacker's activity consumed network resources.
  4. No CIA principle was violated since no data was altered or services disrupted.

Explanation: A passive eavesdropping attack violates confidentiality even without data modification or service disruption - unauthorized observation of sensitive communications is a confidentiality breach. Answer A is correct. Integrity (B) requires modification. Availability (C) requires disruption. The fact that no data was altered or services disrupted does not mean no principle was violated (D).

Question 12

A ransomware attack encrypts a company's production database, making it inaccessible to authorized users. Which element of the CIA triad is most directly compromised?

  1. Confidentiality
  2. Integrity
  3. Availability (correct answer)
  4. Authentication

Explanation: Ransomware prevents authorized users from accessing data by encrypting it, directly attacking availability. Answer C is correct. Confidentiality (A) relates to unauthorized disclosure. Integrity (B) relates to unauthorized modification. Authentication (D) is a control mechanism, not a CIA triad component.

Question 13

A company implements SHA-256 hash verification on software downloads to ensure the files have not been tampered with. This control primarily supports which CIA triad principle?

  1. Availability
  2. Confidentiality
  3. Integrity (correct answer)
  4. Non-repudiation

Explanation: Hash verification confirms that a file's content has not changed since the hash was generated, directly protecting data integrity. Answer C is correct. Availability (A) relates to system uptime. Confidentiality (B) involves restricting access. Non-repudiation (D) involves proof of origin - while related to integrity, it is not the primary CIA principle served here.

Question 14

A company's database administrator accidentally runs a script that updates thousands of customer records with incorrect data. Which CIA triad principle is most directly compromised?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Authorization

Explanation: Incorrect data in customer records - whether from accident or attack - violates integrity: the accuracy and completeness of data. Answer B is correct. Availability (A) relates to access. Confidentiality (C) relates to unauthorized disclosure. Authorization (D) is a control mechanism.

Question 15

Which of the following best describes a trade-off organizations must manage between the CIA triad principles?

  1. Strong confidentiality controls always improve both integrity and availability.
  2. Stronger confidentiality and integrity controls (such as encryption and access restrictions) can sometimes reduce availability by adding latency or complexity. (correct answer)
  3. Availability and integrity cannot coexist because frequent access degrades data accuracy.
  4. The CIA triad principles are independent and never conflict with one another.

Explanation: Security trade-offs are common: strong encryption improves confidentiality and integrity but can introduce processing latency that affects availability; strict access controls protect confidentiality but may slow authorized user access. Answer B is correct. The principles are not always additive (A), not inherently conflicting (C), and they frequently require trade-off management (D).

Question 16

The CIA triad in information security refers to which three core principles?

  1. Confidentiality, Integrity, and Availability. (correct answer)
  2. Compliance, Identity, and Authentication.
  3. Control, Investigation, and Assurance.
  4. Cryptography, Infrastructure, and Access.

Explanation: The CIA triad is the foundational model of information security comprising Confidentiality (protecting data from unauthorized access), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring authorized users can access data when needed). Answer A is correct. Answers B, C, and D are fabricated acronyms not representing the CIA triad.

Question 17

A financial institution discovers that an attacker intercepted and modified wire transfer instructions during transmission, changing the destination account. Which CIA triad principle was violated?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Non-repudiation

Explanation: Modifying data in transit (a man-in-the-middle attack altering transaction data) violates data integrity - the assurance that data has not been improperly changed. Answer B is correct. Availability (A) is not affected. Confidentiality (C) may also be affected if data was read, but the primary violation from modification is integrity. Non-repudiation (D) relates to proof of actions.

Question 18

Which of the following scenarios represents a violation of the confidentiality principle?

  1. A database server crashes and becomes unreachable for four hours.
  2. A payroll file is corrupted due to a software bug, causing incorrect amounts.
  3. An unauthorized employee accesses and reads confidential merger documents stored on a shared drive. (correct answer)
  4. An authorized user accidentally deletes critical financial records.

Explanation: Unauthorized access to and reading of confidential documents is a confidentiality violation - sensitive information is disclosed to someone not authorized to view it. Answer C is correct. Server crash (A) is an availability issue. File corruption (B) is an integrity issue. Accidental deletion (D) is primarily an integrity/availability issue.

Question 19

Which of the following controls most directly supports the availability principle of the CIA triad?

  1. Multi-factor authentication for all user logins.
  2. Encryption of all data stored on company servers.
  3. Digital signatures on outgoing emails.
  4. Redundant data centers with automatic failover capabilities. (correct answer)

Explanation: Redundant data centers with failover ensure that systems remain accessible even if one location fails, directly supporting availability. Answer D is correct. MFA (A) supports authentication and confidentiality. Encryption (B) supports confidentiality. Digital signatures (C) support integrity and non-repudiation.

Question 20

A cloud service provider guarantees 99.99% uptime in its service level agreement (SLA). This SLA commitment most directly supports which CIA triad principle?

  1. Confidentiality
  2. Integrity
  3. Availability (correct answer)
  4. Non-repudiation

Explanation: An uptime SLA commits to keeping systems operational and accessible to authorized users, directly supporting availability. Answer C is correct. Confidentiality (A) and integrity (B) are not addressed by uptime guarantees. Non-repudiation (D) is not a CIA triad component.