Confidentiality Integrity and Availability Questions

Foundational information security framework that focuses on three core goals: confidentiality, integrity, and availability. Confidentiality is about protecting information from unauthorized access and disclosure and includes real world examples such as data leaks, unauthorized access to sensitive records, and privacy violations. Typical controls for confidentiality include encryption for data at rest and in transit, strong authentication and authorization, access control policies, key management, data classification, and least privilege. Integrity is about ensuring information remains accurate and unaltered by unauthorized actors and covers incidents such as data tampering, unauthorized edits, and corruption. Controls for integrity include cryptographic hashes and digital signatures, checksums, tamper detection, versioning and immutability, input validation, audit logging, and integrity verification processes. Availability is about ensuring systems and data are accessible and functioning when needed and covers incidents such as denial of service attacks, infrastructure failures, and capacity exhaustion. Controls for availability include redundancy, replication, load balancing, autoscaling, caching, content delivery networks, failover and disaster recovery planning, backups, maintenance windows, monitoring, and incident response. Candidates should be able to explain these pillars, give concrete examples of breaches and mitigations, describe how to choose and implement technical controls, and reason about trade offs between goals for different systems and business contexts. Assessment often covers threat modeling and risk assessment to prioritize controls, mapping security requirements to service level objectives and service level agreements, defining recovery time objective and recovery point objective, designing for resilience, and communicating security trade offs to stakeholders. Familiarity with security design patterns such as defense in depth, principle of least privilege, secure by design, and zero trust models is useful when applying these principles in architecture and operations.