WGU C836 Fundamentals of
Information Security
Comprehensive Practice Exam
2026–2027 Quality Questions
and Answers with Detailed
Rationales
QUESTION 1
An organization stores customer medical records in a database.
A security administrator configures access controls so that only
authorized healthcare personnel can view the records. Which
security principle is MOST directly being protected?
A. Availability
B. Confidentiality
C. Integrity
D. Nonrepudiation
Correct Answer: B. Confidentiality
,Rationale: Confidentiality protects information from
unauthorized disclosure or access. Restricting medical records to
authorized personnel directly addresses confidentiality.
Availability concerns whether information is accessible when
needed, integrity concerns unauthorized alteration, and
nonrepudiation provides evidence that an action or transaction
originated from a particular party.
QUESTION 2
A database administrator accidentally changes several customer
balances. The organization discovers that the values no longer
match the original transaction records. Which element of the
CIA triad has been MOST directly compromised?
A. Confidentiality
B. Availability
C. Integrity
D. Authentication
Correct Answer: C. Integrity
Rationale: Integrity means information remains accurate,
complete, and protected from unauthorized or improper
modification. Because customer balances were altered and are
no longer trustworthy, integrity has been compromised.
,QUESTION 3
A company's primary web application becomes unavailable
after a distributed denial-of-service attack. Customers cannot
access their accounts even though their information has not
been disclosed or modified. Which security objective was
primarily affected?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Correct Answer: C. Availability
Rationale: Availability ensures authorized users can access
systems and information when required. A denial-of-service
attack is specifically intended to disrupt access to services,
making availability the primary affected element.
QUESTION 4
Which statement BEST describes a vulnerability?
A. An individual who attempts to compromise a system
B. A weakness that could be exploited by a threat
C. The financial loss caused by a security incident
D. A security control implemented to prevent an attack
, Correct Answer: B. A weakness that could be exploited by a
threat
Rationale: A vulnerability is a weakness in technology,
processes, people, or physical environments that could be
exploited. A threat is the potential cause of harm, while risk
represents the potential impact or loss associated with
exploiting a vulnerability.
QUESTION 5
An organization identifies an unpatched operating system as a
weakness. A malicious actor could exploit the weakness to
install ransomware. In this scenario, what is the malicious actor
BEST classified as?
A. Asset
B. Vulnerability
C. Threat
D. Control
Correct Answer: C. Threat
Rationale: The malicious actor represents a threat because it
has the potential to cause harm. The unpatched operating
system is the vulnerability, the computer system is an asset, and
a patching process would be a security control.
Information Security
Comprehensive Practice Exam
2026–2027 Quality Questions
and Answers with Detailed
Rationales
QUESTION 1
An organization stores customer medical records in a database.
A security administrator configures access controls so that only
authorized healthcare personnel can view the records. Which
security principle is MOST directly being protected?
A. Availability
B. Confidentiality
C. Integrity
D. Nonrepudiation
Correct Answer: B. Confidentiality
,Rationale: Confidentiality protects information from
unauthorized disclosure or access. Restricting medical records to
authorized personnel directly addresses confidentiality.
Availability concerns whether information is accessible when
needed, integrity concerns unauthorized alteration, and
nonrepudiation provides evidence that an action or transaction
originated from a particular party.
QUESTION 2
A database administrator accidentally changes several customer
balances. The organization discovers that the values no longer
match the original transaction records. Which element of the
CIA triad has been MOST directly compromised?
A. Confidentiality
B. Availability
C. Integrity
D. Authentication
Correct Answer: C. Integrity
Rationale: Integrity means information remains accurate,
complete, and protected from unauthorized or improper
modification. Because customer balances were altered and are
no longer trustworthy, integrity has been compromised.
,QUESTION 3
A company's primary web application becomes unavailable
after a distributed denial-of-service attack. Customers cannot
access their accounts even though their information has not
been disclosed or modified. Which security objective was
primarily affected?
A. Confidentiality
B. Integrity
C. Availability
D. Nonrepudiation
Correct Answer: C. Availability
Rationale: Availability ensures authorized users can access
systems and information when required. A denial-of-service
attack is specifically intended to disrupt access to services,
making availability the primary affected element.
QUESTION 4
Which statement BEST describes a vulnerability?
A. An individual who attempts to compromise a system
B. A weakness that could be exploited by a threat
C. The financial loss caused by a security incident
D. A security control implemented to prevent an attack
, Correct Answer: B. A weakness that could be exploited by a
threat
Rationale: A vulnerability is a weakness in technology,
processes, people, or physical environments that could be
exploited. A threat is the potential cause of harm, while risk
represents the potential impact or loss associated with
exploiting a vulnerability.
QUESTION 5
An organization identifies an unpatched operating system as a
weakness. A malicious actor could exploit the weakness to
install ransomware. In this scenario, what is the malicious actor
BEST classified as?
A. Asset
B. Vulnerability
C. Threat
D. Control
Correct Answer: C. Threat
Rationale: The malicious actor represents a threat because it
has the potential to cause harm. The unpatched operating
system is the vulnerability, the computer system is an asset, and
a patching process would be a security control.
