Explain the CIA triad and give a real example of an attack on each part.

What the interviewer wants to hear

• Confidentiality means only authorised people can read data
• Integrity means data is not changed without authorisation
• Availability means systems and data are usable when needed
• Gives a concrete attack and a control for each

Model answer

The CIA triad is the base model for security goals. Confidentiality means only authorised people can see data. A data breach, where an attacker steals customer records from a misconfigured cloud bucket, is an attack on confidentiality; controls include access control, MFA and encryption. Integrity means data is accurate and not changed without permission. If an attacker edits bank account details in invoices, that breaks integrity; hashing, digital signatures and change logging help detect it. Availability means systems work when users need them. A DDoS attack or ransomware that encrypts servers attacks availability; controls include DDoS protection, redundancy and tested offline backups. Ransomware with data theft actually hits all three, which is why analysts think about the full triad during an incident.

More easy Cybersecurity Analyst questions

• A user reports a suspicious email. How would you analyse it?
• What is the difference between a firewall, an IDS and an IPS?
• What is a SIEM and how does a SOC analyst use it?
• Explain the difference between hashing, encryption and encoding.
• What is defence in depth, and how would you explain it with a real example?
• What is MFA, and why are some MFA methods stronger than others?
• Explain false positives and false negatives in a SOC. Which is worse, and how do you balance them?
• What is the difference between a vulnerability scan and a penetration test?
• What is the principle of least privilege, and how would you apply it in an organisation?