CompTIA Security+ (SY0-701) (SY0-701) practice questions

A hospital's electronic health record system goes offline for four hours during a ransomware incident, blocking clinicians from reading patient charts. Which pillar of the CIA triad is most directly impacted by this outage?

• AAvailability, because authorised users were unable to access the data when needed.check_circle Correct
• BConfidentiality, because clinicians could not see records they are authorised to view.
• CIntegrity, because the records could not be trusted to be accurate during the outage.
• DNon-repudiation, because the source of the records could not be verified during the outage.

Why A is correct: Availability is the assurance that authorised users can reach systems and data when required. A four-hour outage that blocks clinical access is the textbook impact on availability.

Why B is wrong: Confidentiality concerns unauthorised disclosure, not denial of access to authorised users. The incident may also affect confidentiality if data was exfiltrated, but the four-hour read outage described is fundamentally an availability problem, so this is the wrong best fit.

Why C is wrong: Integrity concerns unauthorised modification or corruption of data. The scenario describes inability to reach the records, not altered content, so integrity is a tempting but incorrect choice.

Why D is wrong: Non-repudiation prevents a party from denying an action they performed and is usually achieved through digital signatures and logging. It is not the pillar harmed by a system being offline, so this option is incorrect.

A finance manager denies approving a large supplier payment, but the workflow tool shows the approval was made using her smart card and signed with her private key, with a tamper-evident audit log. Which fundamental security concept does this control set most directly support?

• AConfidentiality, because the smart card encrypts the approval so only authorised parties can read it.
• BNon-repudiation, because the cryptographic signature and audit trail prevent her from credibly denying the approval.check_circle Correct
• CAvailability, because the workflow tool ensures the approval is always accessible to auditors.
• DAuthorisation, because the smart card grants the manager permission to approve the payment.

Why A is wrong: Smart cards can encrypt data, but the question is about the manager denying she approved the transaction, not about preventing disclosure. Confidentiality is a plausible but wrong fit.

Why B is correct: Non-repudiation is provided by binding an action to an identity through a unique authenticator, such as a private key on a smart card, plus a trustworthy log. The scenario is the textbook use case.

Why C is wrong: Availability concerns timely access for authorised users. The control described is about proving who acted, not about keeping the system reachable, so this is tempting but incorrect.

Why D is wrong: Authorisation decides what an authenticated identity is permitted to do. The scenario centres on proving the action occurred and tying it to the manager, which is non-repudiation rather than authorisation.

A new employee signs in with her username and password, then approves a push prompt on her phone. The system then checks her role and decides she may read invoices but not approve them. Which AAA stage is performing the second check, after authentication has succeeded?

• AIdentification, because the system is matching her username to a stored account.
• BAuthentication, because the push prompt confirms she is who she claims to be.
• CAuthorisation, because role membership determines which actions she is permitted to perform.check_circle Correct
• DAccounting, because the system is recording what she is allowed to do for later review.

Why A is wrong: Identification is when the user first claims an identity, typically by entering a username. It happens before authentication and is not the stage that decides what she may do afterwards.

Why B is wrong: Authentication verifies the claimed identity using factors such as a password plus a push prompt. The question explicitly says this stage has already succeeded, so it is not the answer.

Why C is correct: Authorisation is the AAA stage that enforces what an authenticated identity is allowed to do. Mapping her role to read-only invoice access is a classic authorisation decision.

Why D is wrong: Accounting records what an authenticated user actually does, such as logging the invoice she opened. It is logging, not the permission decision itself, so it is a tempting but wrong choice.