What is the CIA triad, and what is the difference between authentication, authorisation and accounting?

The CIA triad is the foundation of information security:

• Confidentiality — only authorised parties can read the data. Enforced by encryption, access control, and classification.
• Integrity — data has not been altered improperly. Enforced by hashing, digital signatures, checksums, and version control.
• Availability — authorised users can access it when needed. Enforced by redundancy, backups, DDoS protection, and capacity planning.

The three trade off against each other, which is the point interviewers want. Encrypting everything and locking it away maximises confidentiality and harms availability. Ransomware is fundamentally an availability attack. Which corner matters most depends entirely on the system.

AAA — authentication, authorisation, accounting:

• Authentication — proving who you are. Factors are something you know (password), have (token, phone), or are (biometric). Multi-factor means two different categories; a password and a security question are both "know" and are not MFA.
• Authorisation — what you are permitted to do once authenticated. Enforced through RBAC, ABAC, or access control lists.
• Accounting (or auditing) — recording what was done, so actions are attributable and reviewable.

Note: Non-repudiation is a worthwhile addition — the guarantee that someone cannot deny an action, provided by digital signatures and tamper-evident logging.