Home

Tutoring

Subjects

Live Classes

Study Coach

Essay Review

On-Demand Courses

Colleges

Games

Sign up

Log in

Opening subject page...

Loading your content

Practice

  • All Subjects
  • Algebra Flashcards
  • SAT Math Practice Tests
  • Math Question of the Day
  • Live Classes
  • On-Demand Courses

Varsity Tutors

  • Find a Tutor
  • Test Prep
  • Online Classes
  • K-12 Learning
  • College Search
  • VarsityTutors.com

© 2026 Varsity Tutors. All rights reserved.

← Back to quizzes

CPA Isc Quiz

CPA Isc Quiz: Apply Information Security Principles Cia Triad

Practice Apply Information Security Principles Cia Triad in CPA Isc with focused quiz questions that help you check what you know, review explanations, and build confidence with test-style prompts.

Question 1 / 20

0 of 20 answered

The CIA triad in information security refers to which three core principles?

Select an answer to continue

What this quiz covers

This quiz focuses on Apply Information Security Principles Cia Triad, giving you a quick way to practice the rules, question types, and explanations that matter most for CPA Isc.

How to use this quiz

Try each quiz question before looking at the correct answer. Use the explanations to review missed ideas, then come back to similar questions until the pattern feels familiar.

All questions

Question 1

The CIA triad in information security refers to which three core principles?

  1. Confidentiality, Integrity, and Availability. (correct answer)
  2. Compliance, Identity, and Authentication.
  3. Control, Investigation, and Assurance.
  4. Cryptography, Infrastructure, and Access.

Explanation: The CIA triad is the foundational model of information security comprising Confidentiality (protecting data from unauthorized access), Integrity (ensuring data is accurate and unaltered), and Availability (ensuring authorized users can access data when needed). Answer A is correct. Answers B, C, and D are fabricated acronyms not representing the CIA triad.

Question 2

A ransomware attack encrypts a company's production database, making it inaccessible to authorized users. Which element of the CIA triad is most directly compromised?

  1. Confidentiality
  2. Integrity
  3. Availability (correct answer)
  4. Authentication

Explanation: Ransomware prevents authorized users from accessing data by encrypting it, directly attacking availability. Answer C is correct. Confidentiality (A) relates to unauthorized disclosure. Integrity (B) relates to unauthorized modification. Authentication (D) is a control mechanism, not a CIA triad component.

Question 3

Which of the following controls most directly supports the confidentiality principle of the CIA triad?

  1. Redundant power supplies to prevent system downtime.
  2. Hash functions to verify that files have not been altered.
  3. Automated backup systems that run nightly.
  4. Encryption of sensitive data at rest and in transit. (correct answer)

Explanation: Encryption protects data from unauthorized disclosure by making it unreadable without the decryption key, directly supporting confidentiality. Answer D is correct. Redundant power supplies (A) support availability. Hash functions (B) support integrity. Backup systems (C) support availability.

Question 4

A hospital's electronic health record system experiences an unplanned outage during a critical care situation. This event primarily threatens which CIA triad principle?

  1. Availability (correct answer)
  2. Integrity
  3. Confidentiality
  4. Authorization

Explanation: System unavailability during critical need directly threatens the availability principle - the assurance that authorized users can access information when required. Answer A is correct. Integrity (B) and confidentiality (C) are not compromised by an outage alone. Authorization (D) is a control mechanism, not a CIA principle.

Question 5

A company implements SHA-256 hash verification on software downloads to ensure the files have not been tampered with. This control primarily supports which CIA triad principle?

  1. Availability
  2. Confidentiality
  3. Integrity (correct answer)
  4. Non-repudiation

Explanation: Hash verification confirms that a file's content has not changed since the hash was generated, directly protecting data integrity. Answer C is correct. Availability (A) relates to system uptime. Confidentiality (B) involves restricting access. Non-repudiation (D) involves proof of origin - while related to integrity, it is not the primary CIA principle served here.

Question 6

A distributed denial-of-service (DDoS) attack floods a company's website with traffic, causing it to become unavailable to customers. Which CIA triad principle is primarily targeted by this attack?

  1. Confidentiality
  2. Integrity
  3. Authentication
  4. Availability (correct answer)

Explanation: A DDoS attack overwhelms systems to prevent legitimate users from accessing services, directly targeting availability. Answer D is correct. Confidentiality (A) and integrity (B) are not compromised by a DDoS attack. Authentication (C) is a control mechanism, not a CIA principle.

Question 7

A financial institution discovers that an attacker intercepted and modified wire transfer instructions during transmission, changing the destination account. Which CIA triad principle was violated?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Non-repudiation

Explanation: Modifying data in transit (a man-in-the-middle attack altering transaction data) violates data integrity - the assurance that data has not been improperly changed. Answer B is correct. Availability (A) is not affected. Confidentiality (C) may also be affected if data was read, but the primary violation from modification is integrity. Non-repudiation (D) relates to proof of actions.

Question 8

Which of the following scenarios represents a violation of the confidentiality principle?

  1. A database server crashes and becomes unreachable for four hours.
  2. A payroll file is corrupted due to a software bug, causing incorrect amounts.
  3. An unauthorized employee accesses and reads confidential merger documents stored on a shared drive. (correct answer)
  4. An authorized user accidentally deletes critical financial records.

Explanation: Unauthorized access to and reading of confidential documents is a confidentiality violation - sensitive information is disclosed to someone not authorized to view it. Answer C is correct. Server crash (A) is an availability issue. File corruption (B) is an integrity issue. Accidental deletion (D) is primarily an integrity/availability issue.

Question 9

A company implements an intrusion detection system (IDS) that monitors network traffic for suspicious activity and alerts the security team. This control primarily supports which CIA triad principle(s)?

  1. All three - it can detect attacks on confidentiality, integrity, and availability. (correct answer)
  2. Availability only, since IDS primarily prevents denial-of-service attacks.
  3. Integrity only, since IDS monitors data transmission accuracy.
  4. Confidentiality only, since IDS detects unauthorized access attempts.

Explanation: An IDS monitors for a wide range of attacks - unauthorized access (confidentiality), data modification (integrity), and service disruption (availability) - supporting all three CIA principles. Answer A is correct. Limiting IDS to one principle (B, C, or D) understates its broad security monitoring scope.

Question 10

Which of the following controls most directly supports the availability principle of the CIA triad?

  1. Multi-factor authentication for all user logins.
  2. Encryption of all data stored on company servers.
  3. Digital signatures on outgoing emails.
  4. Redundant data centers with automatic failover capabilities. (correct answer)

Explanation: Redundant data centers with failover ensure that systems remain accessible even if one location fails, directly supporting availability. Answer D is correct. MFA (A) supports authentication and confidentiality. Encryption (B) supports confidentiality. Digital signatures (C) support integrity and non-repudiation.

Question 11

A company's database administrator accidentally runs a script that updates thousands of customer records with incorrect data. Which CIA triad principle is most directly compromised?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Authorization

Explanation: Incorrect data in customer records - whether from accident or attack - violates integrity: the accuracy and completeness of data. Answer B is correct. Availability (A) relates to access. Confidentiality (C) relates to unauthorized disclosure. Authorization (D) is a control mechanism.

Question 12

A penetration tester successfully extracts a plaintext database file containing customer names, social security numbers, and financial account numbers. Which CIA triad principle has been violated?

  1. Availability
  2. Integrity
  3. Non-repudiation
  4. Confidentiality (correct answer)

Explanation: Extracting sensitive personal and financial data exposes it to an unauthorized party, violating confidentiality. Answer D is correct. Availability (A) and integrity (B) are not affected by read-only extraction. Non-repudiation (C) is not a CIA triad component.

Question 13

A company implements digital certificates to authenticate the identity of its web server to users. This control most directly supports which CIA triad principle?

  1. Availability
  2. Integrity
  3. Confidentiality (correct answer)
  4. Non-repudiation

Explanation: Digital certificates authenticate the server's identity and enable encrypted communication (TLS/SSL), preventing man-in-the-middle attacks that could expose data - primarily supporting confidentiality. Answer C is correct. Availability (A) is not the primary concern. While certificates also support integrity (B) and non-repudiation (D), their primary role in web server authentication is ensuring secure, confidential communication.

Question 14

An organization's auditor reviews controls over the financial reporting system and finds that journal entries can be posted and deleted without leaving an audit trail. Which CIA triad principle is most at risk?

  1. Availability
  2. Integrity (correct answer)
  3. Confidentiality
  4. Authentication

Explanation: The ability to post and delete transactions without audit trail creates risk that financial data can be manipulated without detection, directly threatening integrity - the accuracy and completeness of financial records. Answer B is correct. Availability (A) is not impacted by missing audit trails. Confidentiality (C) relates to unauthorized viewing. Authentication (D) relates to verifying identity.

Question 15

A cloud service provider guarantees 99.99% uptime in its service level agreement (SLA). This SLA commitment most directly supports which CIA triad principle?

  1. Confidentiality
  2. Integrity
  3. Availability (correct answer)
  4. Non-repudiation

Explanation: An uptime SLA commits to keeping systems operational and accessible to authorized users, directly supporting availability. Answer C is correct. Confidentiality (A) and integrity (B) are not addressed by uptime guarantees. Non-repudiation (D) is not a CIA triad component.

Question 16

Which of the following attack types most directly threatens the integrity principle of the CIA triad?

  1. A SQL injection attack that modifies records in a production database. (correct answer)
  2. A phishing attack that captures user credentials.
  3. A DDoS attack that takes an e-commerce website offline.
  4. A brute-force attack that guesses an administrator's password.

Explanation: SQL injection that modifies database records directly violates data integrity by altering information without authorization. Answer A is correct. Phishing (B) captures credentials, primarily threatening confidentiality. DDoS (C) targets availability. Brute-force attacks (D) threaten confidentiality by enabling unauthorized access.

Question 17

Which of the following is an example of a control that simultaneously supports all three CIA triad principles?

  1. Usernames and passwords for system access.
  2. Daily data backups stored offsite.
  3. A firewall blocking inbound unauthorized traffic.
  4. A comprehensive information security program with layered controls covering access management, data protection, and system resilience. (correct answer)

Explanation: A comprehensive layered security program - with access controls (confidentiality), data validation and integrity monitoring (integrity), and redundancy and recovery controls (availability) - simultaneously addresses all three CIA principles. Answer D is correct. Passwords (A) primarily address confidentiality. Backups (B) primarily address availability. Firewalls (C) primarily protect confidentiality and availability but do not directly address integrity.

Question 18

An organization implements role-based access controls (RBAC) to restrict employees from viewing payroll records unless they are in the HR department. This control primarily supports which CIA triad principle?

  1. Confidentiality (correct answer)
  2. Integrity
  3. Availability
  4. Accountability

Explanation: Restricting access to sensitive payroll data based on user roles prevents unauthorized disclosure, directly supporting confidentiality. Answer A is correct. Integrity (B) concerns data accuracy and modification. Availability (C) concerns access when needed. Accountability (D) is a related security concept but not a CIA triad component.

Question 19

Which of the following best describes the integrity principle of the CIA triad?

  1. Ensuring that only authorized users can view sensitive information.
  2. Ensuring that data is accurate, complete, and protected from unauthorized modification. (correct answer)
  3. Ensuring that systems and data are accessible to authorized users whenever needed.
  4. Ensuring that users are who they claim to be before accessing systems.

Explanation: Integrity is the assurance that data has not been improperly altered, whether through malicious attack, error, or unauthorized access, and that it remains accurate and complete. Answer B is correct. Restricting unauthorized viewing (A) describes confidentiality. System accessibility (C) describes availability. Verifying user identity (D) describes authentication.

Question 20

In the context of the CIA triad, 'non-repudiation' is most closely associated with which principle?

  1. Availability - ensuring that actions cannot be denied by system administrators.
  2. Confidentiality - preventing parties from disclosing who performed an action.
  3. Integrity - providing proof that data was sent or received by a specific party, preventing denial of actions. (correct answer)
  4. Authentication - verifying the identity of users before they perform actions.

Explanation: Non-repudiation provides evidence that a specific party performed an action (e.g., sent a message or authorized a transaction), which is most closely aligned with the integrity principle - ensuring the authenticity and origin of data cannot be denied. Answer C is correct. It is not primarily about availability (A), confidentiality (B), or authentication (D).