Examkin

Question

Difficulty: Very hardCIA Triad & Core Security Concepts

A network security architect is reviewing enterprise controls to align with core security principles across a hybrid multi-cloud environment. Match each technical security mechanism to the primary security principle of the CIA Triad or expanded core concepts it directly fulfills.

  • Implementation of HMAC-SHA256 digests generated using a shared secret for all internal API transaction payloadsIntegrity: Ensures transaction payloads are authentic and have not undergone unauthorized modification or tampering in transit.
  • Deployment of active-active redundant firewalls across geographically dispersed data centers with automated BGP health checks and route failure propagationAvailability: Ensures system access and operational continuity by mitigating single points of failure and network outage vectors.
  • Enforcement of Ephemeral Diffie-Hellman (ECDHE) key exchange within TLS 1.3 session configurationsConfidentiality: Protects session data secrecy by providing Perfect Forward Secrecy (PFS), preventing past session decryption even if long-term server keys are later compromised.
  • Requiring developers to sign code commits using asymmetric private keys linked to identity-verified X.509 certificates and cryptographically timestamped by a trusted RFC 3161 authorityNon-repudiation: Establishes undeniable cryptographic proof of source origin and authorship that prevents the creator from denying their action.

Answer

HMAC-SHA256 payload digests pair with Integrity; Redundant BGP-monitored active-active firewalls pair with Availability; ECDHE key exchange pairs with Confidentiality (PFS); Asymmetrically signed code commits with RFC 3161 timestamps pair with Non-repudiation.
Each security control aligns precisely with its corresponding security principle: HMAC guarantees integrity via tamper detection; dual-homed redundant firewalls guarantee availability through fault tolerance; ephemeral key exchange guarantees confidentiality via forward secrecy; and timestamped asymmetric signatures establish non-repudiation through proof of origin.

Step-by-Step Solution

1
Analyze the technical control in left item 1 (HMAC-SHA256 payload digests).
HMAC produces a keyed cryptographic hash value.
Hashing protects data against unauthorized tampering, which directly maps to the Integrity pillar.
2
Analyze the technical control in left item 2 (Active-active redundant firewalls with automated BGP health checks).
High availability and rapid fault failover infrastructure.
Eliminating single points of failure ensures continuous operational uptime, which maps directly to Availability.
3
Analyze the technical control in left item 3 (Ephemeral Diffie-Hellman key exchange).
Provides Perfect Forward Secrecy by using disposable per-session keys.
Preventing unauthorized decryption of intercepted traffic guarantees data secrecy over time, mapping directly to Confidentiality.
4
Analyze the technical control in left item 4 (Asymmetric private key code signing with RFC 3161 timestamps).
Binds author identity securely to specific code states at precise times.
Prevents the author from denying authorship or claiming modification occurred later, establishing Non-repudiation.

Key Concept

Core Information Security Principles (CIA Triad & Non-repudiation)
Rate this question

Topics

CIA Triad & Core Security Concepts

More questions from this topic