ISC Updated CC Exam Questions and Answers by claire

Non-repudiation ensures that an individual or system cannot deny having performed a specific action, such as sending or receiving a message or approving a transaction. It provides proof of origin and proof of delivery.

This security principle is typically implemented using cryptographic techniques such as digital signatures, public key infrastructure (PKI), hashing, and secure audit logs. For example, a digitally signed message can later be verified, preventing the sender from denying authorship.

Non-repudiation supports accountability, legal enforceability, and forensic investigations. It differs from confidentiality (preventing unauthorized access), integrity (preventing unauthorized modification), and availability (ensuring access).

Non-repudiation is especially important in financial systems, legal communications, and regulated industries where disputes may arise.

Operating system logs are the most relevant source of information for detecting and investigating privilege escalation attacks. These logs record authentication events, privilege changes, process executions, and system-level actions.

Because the attacker already had authorized access, firewall and IDS logs may show little or no suspicious activity. Database logs focus on database-level operations, not OS privilege changes.

OS logs provide the best visibility into actions such as sudo usage, kernel exploits, and unauthorized permission changes. They are essential for forensic analysis and incident response involving insider threats.

Internet of Things (IoT)devices include embedded systems such as sensors, smart appliances, cameras, and industrial controllers that connect to networks and exchange data. These devices often have limited security controls and are common attack targets, making them a significant cybersecurity concern.

The CIA triad provides a foundational framework for understanding and designing security controls.