What is a key goal of information security?

Question

Options

• ACreation of controls and processes to security the organization's data and information resources
• BThe documentation and qualification of risk be the organization to facilitate better decision making
• CThe confidentiality, integrity, and availability of the organization s data and information resources
• Dto reduce adverse impacts on the organization to an acceptable level of risk

• A
  4% (1)
• B
  8% (2)
• C
  4% (1)
• D
  84% (21)

Explanation

Why D is correct: The key goal of information security is to reduce adverse impacts on the organization to an acceptable level of risk. Security can never eliminate all risk - it exists to manage and minimize harm to a tolerable threshold, making this the most accurate high-level goal.

Why the others fall short:

• A describes a means (controls and processes), not the end goal - it's how security is implemented, not why.
• B describes risk documentation and qualification, which is a function of risk management, not information security's primary goal.
• C - the CIA triad (Confidentiality, Integrity, Availability) describes the properties that security protects, not the overarching goal itself. CIA is a framework, not a purpose.

Memory tip: Think of security like a seatbelt - its goal isn't to build the belt (A), document car accidents (B), or define "safety" (C). Its goal is to reduce the impact when something goes wrong to an acceptable level (D). Risk reduction = the "why"; everything else is the "what" or "how."

No community discussion yet for this question.