A company restricts sensitive files so only approved staff can read them. Which security goal is it primarily supporting?

### Why this is right Restricting who can read sensitive files is a way to limit information access to authorized parties. That is the purpose of confidentiality. ### The concept Confidentiality addresses exposure to people who should not see information. Integrity instead concerns improper changes, and availability concerns access for authorized users when needed. A single control can support more than one goal, but the scenario specifically describes restricting viewing. ### The other options - **B. Integrity**: Integrity concerns information accuracy and protection from improper change, not primarily who may read a file. - **C. Availability**: Availability concerns access when required; this scenario restricts access rather than ensuring it. - **D. Incident response**: Incident response is action taken to mitigate a security incident, not a security goal in the model. ### Terms - **Sensitive information**: Information that could cause harm or loss if improperly accessed or disclosed. ### Remember Access restrictions primarily support confidentiality.