General Information Security

Of the three elements of information security (the CIA triad), which best describes integrity?

1. Making sure a user or a piece of data really is who or what it claims to be
2. Keeping information accessible only to authorized parties and not disclosing it to anyone unauthorized
3. Authorized parties being able to use information and information systems without interruption whenever needed
4. Information being accurate and complete, with no unauthorized alteration or destruction

The top page of a company's website was rewritten by an unknown party and now shows completely different content. Which property was most compromised?

1. Availability
2. Non-repudiation
3. Integrity
4. Confidentiality

A company's order-taking site was hit by a flood of concentrated traffic and stopped responding for half a day. Which property was most compromised?

1. Confidentiality
2. Availability
3. Authenticity
4. Integrity

A customer list file was taken outside the company and published on the internet. The file's contents were not altered, and internal operations were unaffected. Which property was most compromised?

1. Reliability
2. Confidentiality
3. Availability
4. Integrity

A company was infected with ransomware, and its business files were encrypted and could no longer be opened. The attacker further warned, “We stole your data before encrypting it. If you do not pay, we will publish it.” Which combination of properties was compromised (or at risk of being compromised) by this event?

1. Availability and confidentiality
2. Reliability and non-repudiation
3. Confidentiality and non-repudiation
4. Integrity and accountability

While editing a summary sheet, a staff member made an operating mistake and saved over a finalized figure with a different value. The file still opens normally and work can continue, but the recorded content no longer matches the facts. Which property was most compromised?

1. Accountability
2. Availability
3. Integrity
4. Confidentiality

In one department, everyone logs into the business system using a single ID shared by the whole department. Which property is most compromised by this practice?

1. Reliability
2. Integrity
3. Accountability
4. Availability

You want to prevent a situation where a business partner who placed an electronic order later claims, “We never placed that order.” Which combination of a property and a countermeasure is most appropriate for this purpose?

1. Availability — making servers and networks redundant
2. Reliability — validating input values
3. Non-repudiation — applying digital signatures
4. Confidentiality — encrypting the communication path

You want to confirm that a message from someone claiming to be a contact person at a business partner really came from that person. Which information security property addresses this purpose?

1. Authenticity
2. Availability
3. Non-repudiation
4. Integrity

In the relationship among threats, vulnerabilities, and risk, which of the following is the most appropriate example of a vulnerability?

1. An outside attacker attempts unauthorized access to the company's servers over the internet
2. A server room floods due to a disaster such as an earthquake or lightning strike, making the equipment unusable
3. The possibility that a leaked customer list results in damages such as compensation claims or loss of trust
4. A business server has been left without a security patch applied

There is a way of thinking about the size of risk as “threat × vulnerability × asset value.” As an information security leader in a business unit, which explanation of how to apply this idea is most appropriate?

1. The most realistic way to reduce risk is for the company to reduce the number of threat occurrences itself through its own effort
2. Because asset value cannot be changed for business reasons, evaluating the size of risk has no bearing on concrete countermeasures
3. If even one of the three factors is large, the risk is always at its maximum regardless of how small the other two factors are
4. Vulnerability is the factor the company can most directly act on, so reducing it lowers risk even if the threat stays the same

When threats are classified into human threats, physical threats, and technical threats, which of the following falls under a physical threat?

1. A server is accessed without authorization from outside
2. Someone is tricked by a fake contact into revealing their password
3. A server stops because a power outage was caused by a lightning strike
4. An employee sends an email to the wrong recipient

It has become clear that the leading cause of information leaks within the company is misdirected email, caused by choosing the wrong recipient. Which response is most appropriate for the information security leader?

1. Prioritize defenses against outside attacks by strengthening the firewall and tightening monitoring of external communications
2. Publicize internally, each time it happens, the name of the employee who sent the misdirected email and the count, to keep everyone alert
3. Put in place pre-send procedures and checks, such as confirming multiple recipients and encrypting attachments
4. Ban the use of email entirely and switch all outside communication to phone, postal mail, or in-person meetings

Which combination correctly makes up the three elements of the “fraud triangle,” a model that explains why internal fraud occurs?

1. People, technology, and physical environment
2. Opportunity, motive, and rationalization
3. Threat, vulnerability, and asset value
4. Confidentiality, integrity, and availability

Among the three elements of the fraud triangle, which control is most appropriate for reducing “opportunity”?

1. Setting up a consultation desk for employees so they can discuss personal worries or financial troubles
2. Repeatedly telling employees in security training that fraud amounts to a crime, to raise awareness
3. Limiting access rights to important data to only those who need them for their work, and periodically reviewing operation logs
4. Clarifying performance evaluation criteria and giving treatment employees find fair, so dissatisfaction does not build up

An employee who took a customer list out of the company said, “I made this document myself, so I thought of it as mine.” Which element of the fraud triangle does this statement represent?

1. Opportunity
2. Motive
3. Threat
4. Rationalization

Among social engineering techniques, which of the following describes trashing (scavenging)?

1. Directly peeking at a user's screen or keyboard input from behind them or from a neighboring seat
2. Collecting information from documents, notes, or storage media that have been thrown away as trash
3. Calling by phone while posing as a system administrator to get a user to reveal their password
4. Following closely behind an authorized person entering a door and passing through without being authenticated oneself

A sales representative frequently opens a laptop at a cafe while out and handles customer information there. Which measure is most appropriate against shoulder surfing?

1. Keep the antivirus software's definition files up to date and run periodic full scans
2. Attach a privacy filter to prevent peeking, and always lock the screen when stepping away
3. Encrypt the communication before sending it to a server outside the company
4. Change passwords periodically and stop reusing the same one across multiple services

It turns out that employees have been saving business files to a free online storage service the company is unaware of, and sharing them within the department. Which of the following is the most appropriate description of the problem with this situation?

1. The organization cannot grasp or control where data is stored or how widely it is shared, so it cannot detect or respond to an incident
2. The cost of storing the files ends up being borne by the department's budget
3. Personal use during working hours increases, creating a labor-management issue that must be addressed
4. Free services have slower transfer speeds than paid ones, which reduces work efficiency when sharing large files

A staff member is due to leave the company next week. Which response to the risk posed by a departing employee should be given the highest priority?

1. Contact the former employee after departure and have them self-report whether they took any data
2. Leave the account active for a while after departure in case it is needed for the handover
3. Let the successor take over and continue using the same ID and password as-is
4. Reliably deactivate the account on the last day and collect any loaned equipment and building access card

The company has strengthened its own defenses, but a computer at a business it outsources work to was infected with malware, and customer data entrusted to that business leaked as a result. Which combination of a name for this kind of threat and an approach to addressing it is most appropriate?

1. Physical threat — strengthen entry and exit control and locking practices for the company's own server room
2. Internal fraud — review the company's own employees' access rights and strengthen operation log checks
3. Shadow IT — ban the use of services the company has not approved and take inventory of usage
4. Supply chain risk — set selection criteria and contractual terms for contractors, and conduct regular reviews

Which of the following is the most appropriate example of a vulnerability caused by an operational shortcoming?

1. Heavy rain floods the basement of a building and submerges equipment installed there
2. A user keeps using a simple, easily guessed password without changing it
3. The information asset inventory has not been reviewed in years and no longer matches reality
4. A programming mistake causes the application to crash when given unexpected input

Which of the following most appropriately describes a zero-day vulnerability?

1. A vulnerability caused by lax password management by users, which can be resolved through training
2. A vulnerability that exists only in products whose support has ended and no longer receive updates
3. A minor vulnerability for which a patch was released within 30 days of discovery
4. A vulnerability that exists before a patch has been made available, or an attack that exploits that state

A serious vulnerability was announced in software used for business, and the vendor stated that “a patch is under investigation with no release date set, but an interim workaround has been published.” Which response is most appropriate for the information security leader?

1. Since the vulnerability is already public, quietly wait and see without informing anyone inside the company, to avoid causing confusion
2. Since there is nothing to be done until a patch is released, wait for it and continue normal operation
3. Combine applying the workaround, taking affected devices off external exposure or isolating them, and strengthening monitoring and recovery preparedness to limit the damage
4. Since keeping the definition files up to date is enough to prevent it, just update the antivirus software and observe the situation

Numerous patches have been released for several servers that make up a business system. Which approach to applying them is most appropriate?

1. Because operations might stop, postpone applying patches until the next system replacement and keep running as-is
2. Apply every released patch immediately to the production environment without prior testing or checking the impact on operations
3. Grasp the affected assets using the asset inventory, prioritize based on severity and business impact, test, and then apply the patches according to a plan
4. Leave the decision of whether to apply patches to each individual user, to be carried out whenever they feel it necessary and convenient

Which of the following most appropriately describes CVE?

1. A portal site that provides vulnerability countermeasure information in Japanese for domestic use
2. A common standard that scores the severity of a vulnerability on a scale from 0.0 to 10.0
3. A testing method that verifies whether intrusion is possible from an attacker's perspective
4. A globally common identification number assigned to an individual vulnerability

An announced vulnerability had a very high CVSS base score. Which way of handling this information is most appropriate?

1. A vulnerability with a high base score must always be addressed with top priority regardless of the affected device's importance or exposure
2. The base score is an indicator determined by the product's sale price, so it is unsuited for judging the priority of countermeasures
3. The base score is a common yardstick, and the organization should decide its own priority by also considering the affected device's importance and its exposure to the outside
4. A higher base score means the attack is harder to carry out, so applying the patch is unnecessary and monitoring alone is sufficient

Which of the following is jointly operated by JPCERT/CC and IPA to provide vulnerability information and countermeasures in Japanese for products used domestically?

1. CVE
2. ISMS
3. CVSS
4. JVN

Which explanation of the difference between vulnerability assessment and penetration testing is most appropriate?

1. Both can be freely carried out from outside without obtaining the permission of the target system's administrator
2. Both involve exactly the same activity, differing only in name
3. Vulnerability assessment is an activity that actually attempts intrusion, while penetration testing is an activity that identifies known weaknesses
4. Vulnerability assessment comprehensively identifies known weaknesses, while penetration testing actually attempts intrusion to verify whether the objective can be achieved

Several of the business PCs used in a department are approaching the end of OS support (EOL). They run stably, and the field has requested that they continue to be used. Which judgment is most appropriate for the information security leader?

1. Installing antivirus software and keeping its definition files updated will maintain safety even after support ends
2. Since there is no problem as long as it runs stably, keep using it until the hardware fails and can no longer be used
3. Because newly found vulnerabilities will no longer be fixed after support ends, plan and carry out an upgrade or replacement before the deadline
4. As long as it is not connected to the internet after support ends, the vulnerability risk disappears

Which of the following most appropriately describes a worm?

1. It encrypts many files used for business, making them unreadable, and demands payment in exchange for restoring them
2. It disguises itself as useful software, gets a user to install and run it, and secretly carries out unauthorized actions such as stealing information
3. It attaches itself to another program or file and spreads when the host is run by a user
4. It needs no host, and spreads on its own as an independent program over a network

Which of the following is the most appropriate characteristic of a virus in the narrow sense?

1. It cannot exist on its own and spreads by attaching itself to another program or file
2. It collects information on a device without the user noticing and sends it to an outside attacker
3. It does not self-propagate, and instead operates by disguising itself as something useful so the user runs it themselves
4. It makes an infected device act on the instructions of an outside command-and-control server, turning it into a launching point for attacks

An employee obtained software introduced as a convenient business tool from the internet and ran it. On the surface it behaved as described, but behind the scenes it was sending internal company documents outside. There is no sign it self-propagated to other devices. Which classification of malware is most appropriate?

1. Trojan horse
2. Worm
3. Macro virus
4. Ransomware

Which of the following most appropriately describes ransomware?

1. It encrypts files or a system to make them unusable and demands a ransom in exchange for restoring them
2. It plants a backdoor that allows entry without going through proper authentication, so it can be freely accessed afterward
3. It remotely controls an infected device from outside and bundles it with others as a launching point for a DDoS attack
4. It secretly logs keyboard input to steal information such as IDs and passwords

An organization is considering its policy for preparing against ransomware damage. Which policy is most appropriate?

1. Since paying the ransom is certain to allow decryption and also prevents recurrence, set aside a budget in advance premised on paying
2. Upon infection, give top priority to promptly reinitializing devices and resuming operations without keeping any records
3. Since damage will not occur as long as backups exist on the same network as the production environment, drills of the recovery procedure and preparation for reporting are unnecessary
4. In addition to backups kept separate from the production environment and drills of the recovery procedure, also prepare reporting and notification processes that assume data has been stolen and may be published

Which of the following most appropriately describes spyware?

1. It collects information and activity on a device without the user noticing and sends it outside
2. It attaches itself to other programs or files and spreads each time the host is run
3. It encrypts files to make them unusable, halting operations and demanding money
4. It self-propagates over a network and floods the connection with heavy traffic, hindering business as a whole

It was found that several PCs inside a company were repeatedly communicating with an outside server not used for business. Investigation revealed that these devices had been infected with malware and, following commands from outside, had taken part in attacks against other companies. Which combination correctly names this malware and the server it communicates with?

1. Spyware — proxy server
2. Ransomware — authentication server
3. Bot — C&C server
4. Macro virus — mail server

Which combination of explanations for keyloggers and backdoors is most appropriate?

1. A keylogger records key input to steal information, and a backdoor creates an entry point that bypasses proper authentication
2. A keylogger encrypts files to make them unusable, and a backdoor provides the decryption key for them
3. A keylogger encrypts communications, and a backdoor decrypts encrypted communications
4. A keylogger self-propagates across an entire network, and a backdoor detects and stops that propagation

Which of the following is the most appropriate reason fileless malware is hard to find with traditional malware countermeasures?

1. It operates solely through the macro function of document files and has no executable file form whatsoever
2. It leaves no file on disk and instead operates in memory or by abusing legitimate OS functions
3. It performs no action at all upon infection and causes no real harm, so there is no need to detect it
4. It runs extremely slowly, falling outside the scope of monitoring and evading detection

Despite always keeping the antivirus software's definition files up to date, damage occurred from an unknown piece of malware. Which understanding of and response to this situation is most appropriate?

1. Because pattern matching can only detect known threats, also use other methods such as behavior-based detection and sandboxing, and prepare a detection, isolation, and recovery system that assumes infection can happen
2. Since infection is impossible as long as the definition files are current, conclude that this incident was a false positive by the product
3. Increasing the update frequency to receive definitions many times a day will eventually let the definitions catch up even with malware not yet known to the world, guaranteeing detection
4. Deploying multiple antivirus products in layers means each product's definition files cover the others' gaps, so no unknown malware can slip through