CIA Triad — Quiz

Part A — Multiple Choice

Q1

Which CIA principle does encryption primarily protect?

A. Integrity B. Availability C. Confidentiality D. Non-repudiation

✅ Correct: C — Confidentiality. Encryption encodes data so only authorized parties can read it. It prevents unauthorized disclosure — the core goal of confidentiality.

Q2

An attacker intercepts a file during transmission and modifies its contents before it reaches the recipient. Which CIA principle is MOST directly violated?

A. Availability B. Confidentiality C. Integrity D. Non-repudiation

✅ Correct: C — Integrity. The file was modified in transit — the data is no longer exactly as the sender intended. Hashing or digital signatures would have detected this alteration.

Q3

Fault tolerance and redundancy are mechanisms that primarily support which CIA principle?

A. Confidentiality B. Integrity C. Non-repudiation D. Availability

✅ Correct: D — Availability. Fault tolerance and redundancy ensure systems keep running even when components fail — maintaining access for authorized users.

Q4

A DDoS attack floods a company's web server, making its website inaccessible. Which CIA principle is violated?

A. Confidentiality — attackers are accessing the server B. Integrity — server data may be corrupted C. Availability — legitimate users cannot access the service D. Non-repudiation — actions cannot be traced

✅ Correct: C — Availability. A DDoS attack denies access to authorized users without necessarily exposing or modifying any data.

Q5

Why is the CIA Triad sometimes called the AIC Triad?

A. AIC emphasizes availability first, which is more important B. To avoid confusion with the US Central Intelligence Agency C. AIC is the international standard name D. CIA is used only for classified government systems

✅ Correct: B. The AIC name avoids ambiguity with the intelligence agency. The principles and meaning are identical — only the order differs.

Part B — Matching

Match each mechanism to its primary CIA principle.

MECHANISM

Hashing

Redundancy

Encryption

Two-Factor Authentication

CIA PRINCIPLE

Integrity

Availability

Confidentiality

Part C — Analysis

Q6 — Analyze

A company's security architecture includes strong encryption and access controls but has no backup systems, no patching schedule, and a single-server infrastructure. Which CIA pillar is most at risk and what is the likely consequence?

A. Confidentiality — encryption can be bypassed B. Integrity — no controls verify data accuracy C. Availability — single point of failure + unpatched vulnerabilities make outages likely D. All three equally — the security posture is poor overall

✅ Best Answer: C — Availability. The company has invested in confidentiality but completely neglected availability. No redundancy means one hardware failure = total outage. Unpatched systems are prime targets for ransomware — the ultimate availability attack.

Part D — Evaluation

Q7 — Evaluate

A security team argues that Confidentiality is the most important CIA pillar for a healthcare organization. A second team argues Availability is more critical because doctors need patient data in emergencies. Who is correct?

A. Confidentiality team — HIPAA compliance requires it B. Availability team — life-critical systems must always be accessible C. Neither — all three pillars are equally important and must be balanced based on context D. Integrity team — patient record accuracy is the most critical

✅ Best Answer: C. In healthcare, ALL three matter critically: Confidentiality (patient privacy / HIPAA), Integrity (wrong medication data could kill patients), Availability (inaccessible records in an emergency = fatal). The CIA Triad is a balance — overemphasizing one at the expense of others creates dangerous vulnerabilities.

CIA Triad Quiz

Part A — Multiple Choice

Part B — Matching

Part C — Analysis

Part D — Evaluation