What is the CIA triad, and why is it a useful way to think about security?
What they are really testing: Whether you have a mental framework for security rather than a grab-bag of tools. They want you to map real controls to confidentiality, integrity, and availability.
A real interview question
What is the CIA triad, and why is it a useful way to think about security?
What most people say
drag me
“CIA is confidentiality, integrity, and availability, the three main goals of security.”
It recites the acronym but does not connect it to controls or show how to use it. The value is as a thinking tool, and the answer never demonstrates applying it.
The follow-ups they ask next
Give an example where focusing only on confidentiality hurts availability.
Encrypting everything with a single key you then lose, or such aggressive access lockdown that legitimate recovery is impossible. Security has to balance all three, not maximize one.
Which leg does a ransomware attack primarily violate?
Availability (data is encrypted away from you), and often confidentiality too if they exfiltrate first. Backups are the availability control that defeats the extortion.
What the interviewer is listening for
- Maps each leg to concrete controls
- Uses it as a design checklist
- Knows the three trade off against each other
What sinks the answer
- Just expands the acronym
- Cannot name controls per leg
- Treats security as only confidentiality
If you genuinely do not know
Say this instead of freezing. Reasoning out loud from what you do know beats silence every single time, and a good interviewer is listening for exactly that.
“CIA is [confidentiality, integrity, availability], and I use it as a checklist. Confidentiality = [encryption, access control, least privilege]; integrity = [hashing, signatures, audit logs]; availability = [redundancy, backups, DDoS protection]. I [walk a design through all three to find the gap], since [strong encryption but no backups still fails on availability].”
Keep going with security
Foundation
Explain the shared responsibility model. Where does the cloud provider's job end and yours begin?
Foundation
What is the difference between authentication and authorization?
Junior
What is the difference between encryption at rest and in transit, and why do you need both?
Junior
How should an application running in the cloud get credentials to call other cloud services? Why avoid long-lived access keys?
Junior
What is the difference between symmetric and asymmetric encryption, and where is each used?
Mid
What does it mean to "shift security left", and how would you build security into a CI/CD pipeline?
Knowing the answer is not the same as recalling it under pressure
Sign in to send the questions you fumble to spaced recall, so they come back right before you would forget them, and learn the concepts behind them with hands-on labs.
Start free