CIA Triad & Security Controls Flashcards

A company implements redundant power supplies and backup generators for its servers. This configuration primarily addresses which CIA property?

Answer: Availability

Redundant power systems ensure servers remain operational during outages, directly supporting availability.

Which security control category includes policies, procedures, and security awareness training?

Answer: Administrative controls

Administrative controls include management-level safeguards such as policies, procedures, and training programs.

A bank teller can view customer balances but cannot transfer funds over $10,000 without manager approval. This is an example of which security principle?

Answer: Least privilege

Least privilege grants users only the minimum access rights necessary to perform their job functions.

An intrusion detection system (IDS) generates an alert when unusual network traffic is observed. This is best classified as which type of control?

Answer: Detective

An IDS is a detective control because it identifies and alerts on suspicious activity without blocking it.

Which of the following attacks most directly threatens data integrity?

Answer: SQL injection modifying database records

SQL injection that modifies database records directly violates integrity by altering stored data without authorization.

A security fence around a data center is classified as which type of control?

Answer: Physical

A security fence is a physical control that restricts unauthorized physical access to a facility.

Which term describes a situation where two or more people are required to complete a sensitive task to prevent fraud?

Answer: Separation of duties

Separation of duties requires that critical tasks be divided among multiple individuals to reduce the risk of fraud or error.