CIA Triad: The Security+ Scenario Shortcut
Security+ uses the CIA triad as a shortcut for matching controls to risk: protect secrecy, protect correctness, or keep systems usable.
Quick answer
Confidentiality protects information from unauthorized disclosure, integrity protects data from unauthorized or accidental change, and availability keeps systems and data accessible when needed. Non-repudiation adds proof that an action or message cannot reasonably be denied.
Start with what failed
If payroll data is exposed to unauthorized users, the failed objective is confidentiality.
If a transaction is modified without detection, the failed objective is integrity.
If a denial-of-service attack keeps users from accessing a service, the failed objective is availability.
- Confidentiality: secrecy and access control.
- Integrity: accuracy, tamper detection, and trusted state.
- Availability: uptime, redundancy, resilience, and recovery.
- Non-repudiation: proof of origin or action, often tied to signatures and logging.
CIA terms compared
Confidentiality
Best for
Preventing unauthorized disclosure.
Exam cue
Private data leaked, unauthorized viewer, encryption, access control.
Common mistake
Choosing integrity when the problem is exposure.
Integrity
Best for
Preventing or detecting unauthorized change.
Exam cue
Tampering, hash mismatch, changed record, altered transaction.
Common mistake
Choosing confidentiality because the data is sensitive.
Availability
Best for
Keeping systems accessible and operational.
Exam cue
Outage, DDoS, redundancy, backups, failover.
Common mistake
Choosing confidentiality when the issue is downtime.
Non-repudiation
Best for
Proving who performed an action or sent data.
Exam cue
Cannot deny, digital signature, audit trail.
Common mistake
Treating it as the same as authentication.
Scenario cues to look for
A database table is changed by an unauthorized process.
Answer: Integrity
The record was altered; correctness and trust are affected.
Why not the distractor: It is not primarily confidentiality unless disclosure is the central issue.
A service is offline after a DDoS attack.
Answer: Availability
Users cannot access the service.
Why not the distractor: The problem is not necessarily data tampering or disclosure.
A signed message proves the sender cannot deny sending it.
Answer: Non-repudiation
The proof-of-action cue is direct.
Why not the distractor: Authentication verifies identity, but non-repudiation focuses on later denial.
Common exam mistakes
Choosing the data type instead of the failure type.
Ask whether the scenario is about exposure, change, or access.
Mixing up integrity and confidentiality.
Integrity is about correctness; confidentiality is about secrecy.
Treating non-repudiation as simple login.
Look for proof that an action cannot be denied later.
Quick practice questions
Answer each question to reveal the explanation. The full app adds tracked results and weak-area review.
Q1.A file hash no longer matches after a download. Which CIA objective is most directly involved?
Q2.A DDoS attack prevents customers from reaching an application. Which objective is affected?
Q3.Which control concept helps prove a user cannot deny sending a message?
Ready to test your knowledge?
Try the free CompTIA Security+ practice test, or use the app for tracked weak-area review.