ITPEC FE Morning April 2023 Question 37

Which of the following is considered a violation of confidentiality?

a)Denial of services to a website handling confidential information by generating fake heavy traffic in the networkb)Destruction of server hardware storing personal information caused by high voltage due to failure of voltage stabilizerc)Disturbing communication by destroying ciphertext of confidential informationd)Tricking a user into providing personal information to a fake website

Explanation

Tricking a user into giving personal information to a fake website — the data reaches someone not authorised to see it, which breaks confidentiality.

The three security properties:

•Confidentiality: only authorised people can read the information.
•Integrity: the information is accurate and is not altered or destroyed without authorisation.
•Availability: authorised users can use the information and systems when they need them.

In (d) the attacker obtains personal information; nothing is changed or made unusable, it is only disclosed.

Answer (d)

Why not others:

•(a) — flooding a website with fake traffic (DoS) blocks access, a loss of availability; the site's data is confidential, but no one reads it.
•(b) — hardware destroyed by a voltage surge makes the data and service unusable, a loss of availability; no one gains access to the personal information.
•(c) — destroying ciphertext in transit damages the data and disrupts communication, a loss of integrity; the plaintext is never revealed.

Key rule: Ask what happened to the information: seen by the wrong person is confidentiality, changed or destroyed is integrity, unusable when needed is availability. The word "confidential" in a scenario does not decide it.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.