TL;DR: CIA names the goals (keep secrets secret, keep data correct, keep systems reachable). AAA names the access process (prove who you are, check what you may do, record what you did). Every control question resolves to one of the six; learn the mapping, not the definitions alone.
The triad in one paragraph each
Confidentiality means only the right eyes see the data. Encryption, access lists, classification labels, and data-loss-prevention rules all serve it. Integrity means data stays correct and complete: hashes detect tampering, signatures prove origin, version control and checksums catch silent corruption, backups restore the known-good state. Availability means authorized users can reach systems when needed: redundancy, failover, backups tested by restore, DDoS absorption, and capacity planning. A ransomware event hits all three at once (data read by criminals, systems altered, services down), which is why it makes such a good exam scenario.
Which controls serve which goal
- Confidentiality controls. AES or ChaCha20 encryption at rest and TLS in transit, strict file permissions (see the Linux sheet for chmod habits), classification and handling labels, DLP blocking outbound sensitive data, screens and clean-desk policy for the physical side.
- Integrity controls. SHA-256 hashes for downloads and evidence, digital signatures on mail and code, write-once audit logs, change management with approvals, file-integrity monitoring that alerts on unexpected edits.
- Availability controls. RAID and clustering, load balancers across zones, tested backups with measured restore times, rate limiting and scrubbing for floods, spare capacity before peak season.
- Crossover controls. Backups serve integrity (known-good copy) and availability (restore fast). Hashing serves integrity directly and confidentiality indirectly (passwords stored as hashes, never plaintext). The exam asks these crossovers deliberately.
Non-repudiation and the AAA bridge
Non-repudiation (proof an action happened, signed so the actor cannot deny it) needs integrity (the record is unaltered) plus AAA's accounting (the record exists and names the actor). Digital signatures plus centralized tamper-evident logging are the standard answer. Whenever a question says "prove who sent it" or "prevent denial," reach for signatures and logs together. Note the dependency: accounting without integrity is just claims, and integrity without accounting is proof about nobody.
AAA step by step
- Authentication: prove identity. Something you know (password, PIN), have (token, smartcard, phone), or are (fingerprint, face), somewhere you are or something you do as supporting factors. MFA combines two different categories; two passwords are still one factor. Methods in exam order of strength: passwords alone (weakest, phishable), MFA (strong), certificate or smartcard auth (stronger), FIDO2 passkeys (phishing-resistant, strongest of the common set).
- Authorization: check permission. After identity comes the access decision: RBAC roles, least-privilege scoping, access-control lists on files and firewall rules. Authentication without authorization is a locked front door with every interior door open.
- Accounting: record the session. Who did what, when, from where. Centralized logs (syslog on port 514), SIEM correlation, session recording for admins. Without accounting, incidents become unsolvable arguments.
The exam's favorite AAA trap: describing MFA and asking which AAA step it is (authentication), or describing a role assignment and asking the same (authorization). Match the verb: prove, permit, record.
The protocol mapping (verified)
- RADIUS (1812 auth, 1813 accounting, UDP). Network-device AAA that encrypts only the password. Combines authentication with authorization.
- TACACS+ (49, TCP/UDP). Encrypts the full payload and separates all three As. Cisco-device standard.
- Kerberos (88). Ticket-based authentication for domains; golden-ticket attacks forge its tickets.
- LDAP (389) and LDAPS (636). Directory lookups, plain and TLS-wrapped. The directory is where authorization data (group memberships) usually lives.
- SAML, OAuth, OpenID Connect. Federation and delegated access for web apps and SSO: prove identity once, carry proof across systems.
Each entry matches the SecLern port bank; the full number list lives in the port cheat sheet.
Three scenarios, worked
- "Users report changed invoice totals." Data correctness is at stake: integrity. Controls: signed approvals on changes, hash-chained audit log, backups to restore known-good figures, investigation of the write path first.
- "The site must survive a datacenter fire." Reachability under failure: availability. Controls: multi-zone deployment, tested failover, backups with measured restore times, a runbook rehearsed before the fire.
- "A contractor laptop with customer data is stolen." Disclosure risk: confidentiality. Controls: full-disk encryption (prevention already bought), remote wipe and key rotation (response now), DLP review of what the role could export (lesson for later).
Each answer follows the verb-first habit: name the goal from the scenario's verb, then pick the control serving that goal. Practice by rewriting any breach headline into one of these three shapes; after twenty rewrites the mapping is reflex.
Data states and classification (where CIA gets applied)
Data lives in three states, each with its own controls: at rest (stored on disks, tapes, buckets: encrypt it, restrict file access, manage keys), in transit (moving across networks: TLS, VPNs, signed mail), in use (loaded in memory during processing: memory protection, trusted execution, minimal exposure). Classification decides how much of each to apply: public (share freely), internal (employees only), confidential (named groups, encrypted, logged access), restricted or regulated (legal handling rules, audit trails). Exam scenarios hand you a data type and ask for handling: customer PII in transit means TLS plus access logging; backups of financials at rest mean encryption plus tested restores; trade secrets in use mean need-to-know access plus endpoint controls. State plus classification picks the control; memorize the pair, not either half alone.
The quiet corruption case (why integrity gets its own controls)
Availability failures announce themselves; confidentiality failures surface in breach headlines. Integrity failures sit silent for months: a miscalculated report, a database row edited by a compromised service account, a backup that has stored garbage since spring. Controls target exactly this silence: file-integrity monitoring alerts on unexpected edits, checksums verify transfers, signatures prove authorship, and restore tests prove the backup holds truth rather than noise. Exam scenarios hint at integrity with words like altered, incorrect, unauthorized change, or untrusted; answer with detection plus recovery, never detection alone.
Answering triad questions under time
Read the scenario's verb first. "Prevent disclosure" or "limit viewing" means confidentiality. "Detect changes" or "prove origin" means integrity. "Keep running" or "survive failure" means availability. "Prove identity," "grant access," "track actions" map to the three As in order. Then pick the control that serves the goal: encryption for secrets, hashes and signatures for correctness, redundancy for reachability. Two-pass reading (goal first, control second) beats memorizing control lists, and the practice-test strategy builds exactly this habit.
Sources
By SecLern Editorial. Published October 18, 2026. Updated October 18, 2026. Protocol ports verified against the SecLern SY0-701 port bank (packs/sy0-701/ports.json).