(A) Incorrect — the employee likely had authorized access to shipping data as part of their job; the issue is modification, not viewing.

(C) Incorrect — the system remained online; packages were shipped to wrong addresses, not prevented from shipping.

(D) Incorrect — delivering packages to wrong addresses is a consequence of the integrity violation, not a separate confidentiality breach.

(B) Incorrect — DDoS floods networks; it does not modify database contents.

(C) Incorrect — DDoS sends junk traffic to overwhelm capacity; it does not intercept or extract data.

(D) Incorrect — the backlog is an operational consequence, not a data integrity violation in the system itself.

(A) Incorrect — RBAC does not directly affect system uptime or availability.

(C) Incorrect — the scenario explicitly states staff cannot VIEW payment data, which is a confidentiality control.

(D) Incorrect — the scenario explicitly states staff cannot MODIFY pricing, which is an integrity control.

(B) Incorrect — this describes two benefits of encryption, not a tradeoff between competing properties.

(C) Incorrect — encryption does not inherently improve availability or prevent corruption; it protects confidentiality.

(D) Incorrect — security measures almost always involve tradeoffs; encryption’s performance cost is a well-known example.

(A) Availability only — the fire destroyed hardware but the scenario does not indicate data was disclosed to unauthorized parties.

(C) Integrity — packages sorted incorrectly is a data/process accuracy issue, not disclosure or access denial.

(D) Availability only — a power outage halts operations but does not disclose data to unauthorized parties.