312-50 Question 3
Single answer▪ Information Security OverviewA healthcare company is launching a web portal that allows patients to view lab results and pay invoices online. During a security review, management states that the top priority is preventing unauthorized disclosure of patient records, while also ensuring records are not altered by attackers and the portal remains available during business hours. Which security objective should the ethical hacker use as the primary framework when assessing the portal's controls?
- A
The CIA triad: confidentiality, integrity, and availability
- B
The five phases of ethical hacking: reconnaissance, scanning, gaining access, maintaining access, and clearing tracks
- C
Nonrepudiation, accounting, and auditing as the complete information security model
- D
Patch management, asset inventory, and backup scheduling as the core security model
Show answer and explanation
Correct answer: A
Explanation
The best answer is the CIA triad because it is the standard foundational model for information security and aligns precisely with the scenario's requirements: preventing disclosure of patient data maps to confidentiality, preventing unauthorized modification maps to integrity, and keeping the patient portal accessible maps to availability. In CEH and broader security practice, ethical hackers assess technical and administrative controls in the context of these objectives. For example, access controls and encryption support confidentiality, input validation and change control support integrity, and redundancy, backups, and resilience measures support availability. This framing is also consistent with widely recognized security guidance such as NIST's definitions of confidentiality, integrity, and availability in FIPS 199 and related security publications.
- A. Correct.
Correct. The scenario directly maps to the CIA triad: confidentiality protects patient records from unauthorized disclosure, integrity ensures records are not improperly modified, and availability keeps the portal accessible to authorized users. In an information security overview context, the CIA triad is the foundational model used to evaluate whether security controls address the organization's primary protection goals.
- B. Incorrect.
Incorrect. These are commonly cited phases of an attack or penetration-testing workflow, not the primary framework for defining information security objectives. An ethical hacker may use these phases when planning an engagement, but they do not describe the core protection goals the organization is trying to achieve.
- C. Incorrect.
Incorrect. Nonrepudiation, accounting, and auditing are important security concepts and control areas, but they are not the complete foundational model for information security objectives. A candidate might select this because healthcare environments require logging and proof of actions, but those controls support broader goals such as integrity and accountability rather than replacing the CIA triad.
- D. Incorrect.
Incorrect. Patch management, asset inventory, and backup scheduling are valuable operational security practices. However, they are specific control activities, not the overarching framework used to categorize and assess the security objectives in the scenario. For example, backups mainly support availability and recovery, but they do not by themselves define all core information security goals.