CIA and Non-Repudiation

CompTIA Security+ SY0-701

Track your progress as you read

Finished sections get a check mark.

1 Introduction & Exam Overview

Current Exam Facts and How Security+ Tests Judgment Domain Weighting and an 8-12 Week Study Plan Practice Questions, PBQs, and the Missed-Question Notebook

2 Domain 1: General Security Concepts (12%)

CIA and Non-Repudiation Control Types and Categories with Scenario Classification Security Principles: Least Privilege, Defense in Depth, Secure by Design, and Zero Trust Change Management and Business Impact

3 Domain 1: Identity, Trust, and Cryptography Basics

AAA and IAM Concepts Authentication Factors and MFA Traps Authorization Models: RBAC, ABAC, MAC, DAC, and Least Privilege Cryptography, Hashes, Signatures, PKI, and Certificate Decision Rules

4 Domain 2: Threat Actors, Vectors, and Social Engineering

Threat Actors and Motivations Attack Vectors and Attack Surface Social Engineering Types and Clues Supply Chain and Insider Threat Scenarios

5 Domain 2: Threats, Vulnerabilities, and Mitigations - Attacks

Malware Behaviors and Indicators Credential and Password Attacks Network and Wireless Attacks Application, API, and Cloud Attacks with Mitigation Mapping

6 Domain 2: Threats, Vulnerabilities, and Mitigations - Vulnerabilities

Vulnerability Types and Misconfiguration Vulnerability Scanning and Prioritization Secure Coding and Application Mitigations Remediation, Compensating Controls, and Risk-Based Decisions

7 Domain 3: Security Architecture - Secure Architecture Models

Architecture Models and Trust Boundaries Cloud Shared Responsibility and Service Models Zero Trust, SASE, and SSE Concepts Secure Design Review Scenarios

8 Domain 3: Security Architecture - Network Security Architecture

Segmentation, VLANs, DMZ, and Microsegmentation Firewalls, WAF, IDS, IPS, and Proxies VPN, Remote Access, and NAC Wireless Security and Enterprise Network Design

9 Domain 3 Part C: Data Protection and Resilience

Data Classification and Handling Encryption at Rest, in Transit, in Use, and Key Management DLP, Privacy, and the Data Lifecycle Backups, RTO, RPO, BCP, DR, and Resilience

10 Domain 4 Part A: Secure Operations for Hosts, Cloud, Mobile, and IoT

Endpoint and Server Hardening Cloud, Container, and Virtualization Operations Mobile, BYOD, and MDM Embedded, IoT, OT, and Physical Device Security

11 IAM Operations and Access Control

Provisioning, Deprovisioning, and Access Reviews PAM, JIT, JEA, and Service Accounts Federation, SSO, SAML, OIDC, and OAuth Account Attacks and IAM Monitoring

12 Logging, Monitoring, and Detection

Log Sources and Telemetry SIEM Correlation and Alert Triage SOAR, Playbooks, and Automation Detection Use Cases and False-Positive Handling

13 Incident Response

IR Phases and Roles Containment, Eradication, and Recovery Decisions Communication, Escalation, Legal, and Regulatory Considerations Post-Incident Lessons Learned and Metrics

14 Digital Forensics and Investigation

Evidence Handling and Chain of Custody Disk, Memory, Network, and Log Artifacts Order of Volatility and Acquisition Choices Forensic Reporting and Anti-Forensics Traps

15 Vulnerability, Patch, Asset, and Automation Operations

Asset Inventory and Data Classification in Ops Vulnerability Lifecycle and CVSS/Risk Priority Patch, Change, and Configuration Management Automation, Orchestration, SCAP, and Security Tooling

16 Governance, Policies, and Risk Management

Governance Documents: Policy, Standard, Procedure, and Baseline Risk Register and Risk Treatment Quantitative/Qualitative Risk and BIA Exceptions, Acceptance, Ownership, and Reporting

17 Third-Party Risk, Compliance, and Privacy

Vendor Risk Lifecycle and Agreements Due Diligence, Questionnaires, and Monitoring Privacy Concepts and Data Rights Compliance Reporting and Consequences

18 Audits, Penetration Testing, and Awareness

Internal and External Audits and Evidence Penetration Test Types and Rules of Engagement Security Awareness, Training, and Phishing Metrics Personnel and Physical Security Program Controls

19 Final Review and PBQ Labs

PBQ Workflow and Timing Ports, Protocols, and Acronyms High-Yield Tables Firewall, IAM, Log, and Risk PBQ Mini-Labs Final 7-Day Review Plan Mixed Exam Strategy and Missed-Question Remediation

CIA and Non-Repudiation

Key Takeaways Explain This Topic AI

Confidentiality protects against unauthorized disclosure; encryption, access control, classification, and masking enforce it.

Integrity protects against unauthorized or unexpected modification; hashing, digital signatures, and file integrity monitoring detect it.

Availability keeps systems, services, and data usable when needed; redundancy, failover, and backups preserve it.

Non-repudiation depends on trustworthy identity, record integrity, synchronized time, and preserved evidence — a log alone is not enough.

SY0-701 scenarios ask which part of the CIA triad is PRIMARILY affected even when several are touched — read the stem's outcome verb.

Last updated: October 2026

CIA as a Decision Tool

The CIA triad — confidentiality, integrity, and availability — is the foundation of objective 1.2 on the current CompTIA Security+ SY0-701 exam (launched November 2023; up to 90 questions in 90 minutes; passing score 750 on a 100–900 scale; $439 voucher in the United States). Domain 1, General Security Concepts, is 12% of the exam, but its vocabulary recurs across all five domains. Treat the triad as a fast classifier: it tells you what went wrong, which risk is highest, and which control is most relevant.

Principle Protects against Common controls Scenario clue

Confidentiality Unauthorized disclosure Encryption, access control, data masking, classification, DLP "exposed", "read by", "leaked", "public site"

Integrity Unauthorized or unexpected change Hashing, digital signatures, file integrity monitoring, input validation "modified", "tampered", "hash mismatch", "altered"

Availability Loss of access or service Redundancy, failover, backups, capacity planning, anti-DDoS "unavailable", "outage", "latency", "locked out"

Non-repudiation Credible denial of an action Digital signatures, audit logs, time stamps, strong identity proof "cannot deny", "prove who approved", "signed"

Non-repudiation is grouped with the triad on SY0-701 even though it is not strictly part of CIA. It is the assurance that a party cannot later deny having performed an action — critical for contracts, financial approvals, and forensic accountability.

Scenario Classification

The exam rarely asks "define confidentiality." It describes an event and asks which principle is primarily affected. Map the outcome verb to a principle.

Scenario Primary principle Why

A contractor downloads customer records from a folder they should not access Confidentiality Data was disclosed to an unauthorized party

A payment file hash does not match the known-good value Integrity Evidence suggests unauthorized or accidental modification

A DDoS attack prevents customers from reaching a portal Availability The service cannot be used when needed

A manager disputes approving a high-risk firewall exception Non-repudiation The business needs reliable proof of who approved the action

Non-Repudiation Requires More Than a Log

An audit log supports non-repudiation only if the identity and the log's integrity are trustworthy. A shared admin account with editable local logs is weak evidence; a named account with multi-factor authentication (MFA), centralized append-only logging, synchronized time, and ticketed approval is strong evidence.

• Weak evidence Stronger evidence
• Shared administrator account Named privileged account with MFA
• Local log file on the same server Centralized tamper-resistant (write-once) logging
• No time synchronization NTP-backed time stamps across hosts
• Verbal approval Signed or ticketed approval with approver identity
• Plain message content Digital signature tied to a private key

Digital signatures deliver non-repudiation because only the holder of the private key could have produced the signature, and the matching public key proves it — while simultaneously providing integrity. Encryption alone does not, because anyone with the symmetric key could have authored the message.

A useful way to internalize the difference: confidentiality is about who can see , integrity is about whether it changed , availability is about whether it works , and non-repudiation is about who can be held responsible . A single sentence in an exam stem usually emphasizes exactly one of these four outcomes, and your job is to match the emphasized outcome to its principle while ignoring the plausible-but-secondary effects the question deliberately mentions to distract you. Candidates lose points by selecting the principle that is technically also true rather than the one the scenario is actually about.

Exam Trap: More Than One CIA Impact

Real incidents touch several principles at once. Ransomware can violate confidentiality (data exfiltrated before encryption — the modern "double extortion" pattern), integrity (files altered or corrupted), and availability (files encrypted and unusable). The exam still wants ONE primary answer, so anchor on the stem's stated outcome:

"Users cannot access encrypted files" → availability is primary.

"Stolen files appeared on a leak site" → confidentiality is primary.

"Records were silently changed to alter balances" → integrity is primary.

A second classic trap pairs the wrong control with the goal. Encryption protects confidentiality, not integrity; a hash detects change but does not stop it; a backup restores availability but does nothing to prevent disclosure.

Fast Rule (Apply in Order)

• Question If yes, think
• Did someone see data they should not see? Confidentiality
• Did data or code change without authorization? Integrity
• Can users or systems use the service when needed? Availability
• Does the organization need proof a specific party acted? Non-repudiation

Work the list top to bottom and stop at the first match the stem emphasizes. This ordering mirrors how SY0-701 distractors are built: they offer a true-but-secondary principle alongside the primary one to test whether you parsed the outcome rather than the surrounding noise.

Finally, watch for non-CIA distractors planted in answer lists, such as "deterrence" or "authentication." Deterrence is a control category, not a triad property, and authentication is the mechanism that supports confidentiality and non-repudiation rather than a principle in its own right. When all four CIA-style options appear, the answer is almost always one of confidentiality, integrity, or availability — non-repudiation surfaces only when the stem explicitly involves proving or denying that a specific party performed an action, such as a disputed approval, a signed transaction, or an audit finding that must hold up under later challenge.