AP Networking 4.1: What Happens When Networks Break or Fail?

When a business network breaks, the first question is not "how do we fix it?" It is "which pillar just failed?" Confidentiality, integrity, and availability, the CIA triad, are the basis of secure and reliable network communication, and each leaves its own evidence when it breaks. This guide teaches you to read that evidence like an analyst and to explain what unreliable connectivity costs an organization.

Unit 4 moves you from networks you built to networks a business depends on. The unit scenario: you are an IT support intern at a local grocery store. On the busiest Saturday of the month, prices display wrong, the inventory system claims shelved items are out of stock, and payment processing turns unreliable. The manager wants one answer fast: glitch, or security incident? By the end of this topic you can answer with evidence.

• The CIA triad: three promises every network makes
• Reading the evidence: which pillar broke?
• How incidents are investigated
• A full worked walkthrough
• What downtime really costs an organization
• Practice: Incident Triage
• Using AI to triage alerts, safely
• Key terms
• Frequently asked questions

The CIA triad: three promises every network makes

Every secure, reliable network keeps three promises. Confidentiality: only authorized individuals, systems, or processes access the data. Integrity: the data are accurate, trustworthy, and have not been altered. Availability: data and services are accessible to authorized entities when they need them. Break any one and you have an incident, whether or not an attacker was involved.

Pillar	The promise	Broken at the store looks like
Confidentiality	Only authorized people, systems, or processes access the data	The customer loyalty list turns up outside the store's systems
Integrity	Data are accurate, trustworthy, and unaltered	Shelf displays show prices nobody approved
Availability	Data and services are reachable by authorized users	Card readers time out and registers drop their connection

Notice what the integrity row implies: a system can be fully online, responding instantly, and still be compromised, because the data it serves are false. Up, but wrong, is an integrity breach, not an availability one, and that distinction costs students more points than anything else here.

Reading the evidence: which pillar broke?

Each pillar fails with a recognizable signature. Learn the four indicators for each and classification becomes pattern matching against evidence, not guessing.

Pillar compromised	What you will find in the evidence
Confidentiality (data exposed or stolen)	Unauthorized access; network traffic showing exfiltration of sensitive data; exposed credentials; unusual activity on sensitive data
Integrity (data false or inaccurate)	Unauthorized data changes; inconsistencies in logs; unauthorized software installations; corruption of data
Availability (service out unexpectedly)	Inability to access systems, networks, or resources; slow or dropped connections; unexpected high volume of network traffic; frequent error messages

Try it on three quick reads

A firewall alert shows 2.3 GB of the loyalty database leaving for an unknown external address at 1:15 am: exfiltration, so confidentiality. The change log records 1,240 overnight price updates by an account with no approved change window: unauthorized data changes, so integrity. The internet link floods and card readers time out at noon: unexpected traffic volume plus dropped service, so availability. Same skill each time: find the indicator, name the pillar.

How incidents are investigated

Real incidents rarely break one pillar politely and stop. Triad violations often occur together, and the combination hits harder than any single one. A traffic flood that takes the registers down can be cover for a quiet exfiltration. So investigators never scope an incident from a single alert; they establish what happened, who was affected, and how data or services were impacted by reviewing five kinds of artifacts:

• Access logs: who authenticated, when, from where, and what they touched
• Alerts from firewalls and network monitoring tools
• Error reports from systems and applications
• Missing or corrupted files
• Network outages or slowdowns and their timing

A full worked walkthrough

Here is the Saturday incident worked end to end, the way you will document it for the manager.

The visible problem. 12:40 pm, peak traffic. Card readers time out and the monitoring dashboard shows the WAN link saturated:

netmon 12:40:12 WAN inbound 99.8% util; payment-gateway requests timing out

Unexpected high traffic volume, dropped service. That is an availability breach, and on the busiest day of the week it is bleeding sales by the minute.

The wider scope. Before writing "outage" on the report, you pull the access log for the previous night:

auth-log 03:10:02 login OK user=mgr-01 (47 prior failures); bulk read loyalty.*

Forty-seven failed logins, a success at 3:10 am, then bulk reads of loyalty records. Unauthorized access and unusual activity on sensitive data: confidentiality signatures. The outage is real, but it is not the whole incident. The report now says: probable credential compromise overnight, sensitive data read, availability disruption at peak, scope still widening. Two log lines, and the manager knows more than an hour of speculation would tell them.

What downtime really costs an organization

The second half of this topic is the business half. Connectivity carries an organization's essential work: communication, data access, and service delivery. When it is unreliable, employees lose access to essential systems, and the result is delays, errors, and lost productivity, even when no attacker exists.

Timing and target set the price

A 30-minute outage is not one fixed cost. At the store, 30 minutes at Saturday noon means missed transactions and abandoned carts; the same 30 minutes at 3 am Tuesday costs almost nothing. Peak-activity outages cause greater impacts than low-usage ones. And for critical infrastructure, emergency response, power, and water, there is no low-usage window: disruption at any time can be severe. In the food supply chain, healthcare, and the military, a disruption carries functional and public safety consequences, not just financial ones.

Repeated outages compound

Long-term consequence	How it shows up
Financial loss	Missed transactions during downtime plus reduced productivity while systems are unreliable
Reputational damage	Customers and investors quietly choose the competitor whose registers work
Erosion of public trust	Hits hardest for public institutions and critical services, where trust is the product

This is why the manager's question deserves a fast, evidence-based answer: every hour of confusion is an hour of all three costs accruing.

Practice: Incident Triage

Warm up with three sample questions, then triage the store's full evidence set yourself. Cards and answer choices are shuffled every run, so you have to reason from the indicators.

Three free sample questions

1. The inventory system reports 312 items out of stock, but staff can see them on the shelves. The sync log shows unreadable records with checksum mismatches. Which pillar broke?

Show answer

Integrity: corruption of data is an integrity signature (EK 4.1.A.4). The system is up and answering; its answers are false.

2. Which evidence points to a confidentiality breach: frequent error messages, exposed credentials, or an unauthorized software installation?

Show answer

Exposed credentials (EK 4.1.A.3). Frequent errors point to availability (EK 4.1.A.5); an unauthorized installation points to integrity (EK 4.1.A.4).

3. The same 30-minute outage hits a grocery store at Saturday noon and a 911 dispatch center at 3 am. Which one is severe?

Show answer

Both, for different reasons: peak-time outages cost commerce the most, and critical infrastructure has no safe window at all (EK 4.1.B.2).

Using AI to triage alerts, safely

A managed network generates more log lines in a day than you can read in a week, and AI log-analysis tools are genuinely good at compressing them into a summary. Use them. Then verify, because a summary is a theory about the evidence, not the evidence. An AI that reports "availability outage caused by a traffic spike" while the access log shows an after-hours login and bulk reads of sensitive data has under-scoped the incident, and violations travel together often enough that under-scoping is the expensive mistake. The habit: AI summarizes, the analyst verifies against the raw artifacts. Spot-check the log lines behind every AI conclusion before it goes in the report.

Key terms

CIA triad

Confidentiality, integrity, and availability: the basis of secure and reliable network communication.

Confidentiality

Only authorized individuals, systems, or processes access data.

Integrity

Data are accurate, trustworthy, and have not been altered.

Availability

Data and services are accessible to authorized entities.

Exfiltration

Sensitive data moving out of the network to an unauthorized destination; a confidentiality signature.

Exposed credentials

Usernames, passwords, or keys visible to people who should not have them.

Access log

The record of who authenticated, when, from where, and what they touched.

Incident scope

What happened, who was affected, and how data or services were impacted.

Frequently asked questions

What is the CIA triad in networking?

The three properties every secure, reliable network protects: confidentiality (only authorized access to data), integrity (data are accurate and unaltered), and availability (data and services reachable by authorized users).

What is an example of a confidentiality breach?

Sensitive data leaving the network to an unknown destination, credentials posted publicly, unauthorized logins, or unusual activity on sensitive records. The common thread: someone unauthorized can see the data.

What is an example of an integrity breach?

Unauthorized data changes, corrupted files, inconsistencies in logs, or software installed without authorization. The data or system state can no longer be trusted, even if everything is still running.

What is an example of an availability breach?

Systems or resources that cannot be reached, slow or dropped connections, an unexpected flood of network traffic, or frequent error messages. Authorized users are cut off from what they need.

Is a defaced website an integrity or availability problem?

Integrity. The site is still up and serving pages; the content has been altered without authorization, so the data are false. Availability would be the site failing to respond at all.

Can one incident break more than one CIA pillar?

Yes, and it is common: triad violations often occur together, which multiplies the impact. That is why investigators review access logs, alerts, error reports, damaged files, and outages before declaring an incident's scope.

What evidence do incident investigators review?

Access logs, alerts from firewalls and network monitoring tools, error reports, missing or corrupted files, and network outages or slowdowns. Together they establish what happened, who was affected, and how data or services were impacted.

Why does an outage at peak hours cost more?

Because impact scales with how much essential work the network was carrying when it failed. A store loses real transactions at Saturday noon and almost none at 3 am. Critical infrastructure like emergency response is the exception: any outage is severe.

What are the long-term effects of repeated network outages?

Financial loss from missed transactions and reduced productivity, reputational damage that discourages customers and investors, and erosion of public trust, which hits public institutions and critical services hardest.

Should I trust an AI tool's summary of security logs?

Treat it as a starting theory. AI is excellent at compressing thousands of log lines, but it can under-scope an incident. Verify its conclusions against the raw access logs and alerts before acting on them.

AP is a trademark of the College Board, which was not involved in the production of, and does not endorse, this resource.