(ISC)2 Certified in Cybersecurity Practice Exam

What constitutes a security incident?

1. Any unauthorized access to data

2. An event threatening confidentiality, integrity, or availability

3. A successful attack on a system

4. A routine check of security measures

The correct answer is: An event threatening confidentiality, integrity, or availability

A security incident is defined as an event that threatens the confidentiality, integrity, or availability of information systems or data. This encompasses a broad range of scenarios where security measures could be compromised, not just limited to unauthorized access or successful attacks. The concept emphasizes the potential impact on key security principles, which are known as the CIA triad (Confidentiality, Integrity, Availability). For example, a security incident can occur through a multitude of vectors, such as malware infections, unauthorized access attempts, or even insider threats. While unauthorized access to data and successful attacks on systems are indeed incidents, they are narrower in scope. The definition of a security incident is not limited to specific events but rather includes any occurrence that poses a risk to overall security. On the other hand, routine checks of security measures do not qualify as incidents because they are proactive actions designed to mitigate risks, rather than events that indicate a compromise or threat to security. Thus, the comprehensive nature of the correct answer effectively captures all potential incidents that may harm an organization’s information security posture.