Examkin

Question

Difficulty: Very hardCIA Triad & Core Security Concepts

A network security administrator is evaluating an automated log collection architecture. Network routers and switches are configured to transmit syslog messages to a centralized syslog server over an encrypted TLS connection. However, the syslog server writes the received log streams directly to a disk volume without generating message digests, cryptographic hashes, or digital signatures. During a post-incident investigation, security analysts discover that an attacker compromised local host credentials on the log server and modified historic log entries to erase evidence of lateral movement. Which security pillar of the CIA triad was directly compromised due to the lack of log hashing or cryptographic validation?

  1. Integrity, because the storage mechanism lacks controls to detect or prevent unauthorized modification of the log data.Answer
  2. B
    Confidentiality, because encrypted TLS transmission failed to protect log content while in transit across the network.
  3. C
    Availability, because unauthorized modifications prevented network administrators from accessing the syslog daemon.
  4. D
    Non-repudiation, because network devices failed to authenticate the identity of the central syslog destination server.

Answer

Integrity, because the storage mechanism lacks controls to detect or prevent unauthorized modification of the log data.
The correct answer highlights Integrity because the core security gap stems from the storage repository failing to apply cryptographic hashing (such as SHA-256) or digital signatures to stored log files. Integrity ensures that data remains whole, accurate, and protected against unauthorized modification or tampering.

Step-by-Step Solution

1
Analyze the security controls active during transit and storage.
TLS protects syslog messages while in transit (Confidentiality and basic transit protection), but no cryptographic hashes or signatures are applied upon disk storage.
Identifying missing security controls pinpoints which phase of the data lifecycle is vulnerable.
2
Evaluate the nature of the security incident described in the scenario.
An attacker altered historical log entries to remove evidence of lateral movement.
Unauthorized alteration of data directly impacts the trustworthiness and authenticity of stored information.
3
Map the specific failure and control gap to the CIA Triad pillars.
The inability to verify data authenticity or detect tampering represents a failure of Integrity.
Integrity guarantees that data has not been modified, altered, or destroyed in an unauthorized manner.

Key Concept

CIA Triad: Integrity and Data Immutability Controls
Rate this question

Topics

CIA Triad & Core Security Concepts

More questions from this topic