Information Security Countermeasures

Regarding the timing and content of information security training for new employees, which of the following is most appropriate?

1. Before they begin work, explain the company's information security policy and the regulations they must follow on the job
2. Have them experience the work of their assigned department for a year first, and only provide the training once they personally feel its necessity
3. Target it only at those assigned to the information systems department, explaining device configuration procedures in detail
4. Since separate annual training is given to the whole company, skip individual training for new employees and fold it into the annual training instead

Which of the following is the most appropriate purpose for carrying out a targeted-attack email drill?

1. Verifying whether the firewall's communication rules are configured correctly
2. Analyzing the malware samples collected through the drill to create new pattern files
3. Identifying and disciplining the employees who opened the drill email, to prevent recurrence
4. Establishing the behavior of not opening a suspicious email and immediately reporting it to the contact point

Regarding a non-disclosure agreement (NDA) signed with an employee, which of the following is appropriate?

1. Once the agreement is signed, there is no longer any need to check on the contractor's management practices
2. It is signed only with regular employees; temporary staff and part-time workers can be excluded from it
3. It is common to state that the duty of confidentiality continues for a set period even after leaving the company
4. It is valid only while the person remains employed, and the duty of confidentiality disappears the moment they leave

Regarding the information security procedures that accompany an employee's departure, which of the following is most appropriate?

1. Disable the business system account by the employee's last working day, and collect any loaned equipment
2. Do not collect loaned items such as an ID card or keys until the person offers to return them
3. Since the duty of confidentiality disappears upon departure, skip reconfirming it at the time of leaving
4. Leave the account usable even after departure, so business inquiries can still be answered

Information security measures can be organized into human, technical, and physical measures. Which of the following falls under a human measure?

1. Encrypting important files before storing them
2. Managing entry and exit to the server room with IC cards
3. Using a firewall to block unnecessary communication from outside the company
4. Carrying out a targeted-attack email drill for all employees

Regarding how to handle a situation where business is outsourced and the contractor's staff handle the company's personal data, which of the following is most appropriate?

1. Set out confidentiality and subcontracting conditions in the contract, require a level of management equivalent to the company's own, and check on how it is actually being carried out
2. Since the contractor's staff are not the company's own employees, exclude them from information security training or pledges
3. Prioritize efficiency for subcontracting, and allow it based solely on an informal understanding between the frontline staff involved
4. Since management is the contractor's responsibility, stop checking on it from the company's own side once the contract is signed

Which of the following initiatives can be expected to be effective in deterring internal fraud?

1. Informing employees in advance that access logs are being taken for important data
2. Applying no restriction on privileges for management staff, letting them freely view all information at any time
3. Keeping the fact that logs are being taken hidden from employees, and rounding up and exposing violators later
4. Setting up no consultation channel for wrongdoing and instead having whoever notices it warn the person directly

Which of the following is the most appropriate content for information security training aimed at managers?

1. The responsibility that comes with approving a subordinate's access rights, and the escalation procedure for when a report comes in
2. The procedure for identifying and disciplining a subordinate who opened an attachment during a targeted-attack email drill
3. Learning the concrete configuration procedures for servers and network equipment, so they can make configuration changes on their own judgment
4. Covering the same content as the training given to all employees, with nothing specific to managers

Which of the following correctly classifies the following three measures as human, technical, or physical? (a) Signing a non-disclosure agreement with employees. (b) Securing a laptop to a desk with a security cable. (c) Encrypting communication with the file server using TLS.

1. (a) Physical, (b) Human, (c) Technical
2. (a) Human, (b) Technical, (c) Physical
3. (a) Technical, (b) Physical, (c) Human
4. (a) Human, (b) Physical, (c) Technical

Which of the following is the information a packet-filtering firewall uses to decide whether to allow or deny a communication?

1. The actual content of a value entered into a web application's input field
2. The parent-child relationship between processes run on a device, and when they were launched
3. The source and destination IP addresses, port numbers, and protocol
4. Words or expressions contained in the body of an email

Which of the following correctly describes stateful inspection in a firewall?

1. It remembers the state of a connection and dynamically allows the response packets to communication that originated from inside
2. It is installed on each device, continuously monitors for suspicious behavior from unknown malware, and automatically isolates the device
3. It inspects the content of requests to a web server, detecting and blocking attacks such as SQL injection
4. It uses DNS information on the receiving side to verify whether an email's sending domain is genuine

Which of the following is most appropriately placed in a DMZ?

1. The company's own web server, published to the internet
2. The application server for an accounting system used internally
3. An internal database server storing HR information
4. A directory server that only authenticates internal users

The table below shows the connection-permission rules of a certain firewall. Rules are evaluated in order from the lowest number, and the action of the first matching rule is applied. Any traffic that matches no rule is denied at the end (implicit deny). When a PC on the internal LAN connects to a website on the internet over TCP/443, which combination of the rule number applied and the resulting outcome is correct?

番号  送信元          宛先            サービス    動作------------------------------------------------------1     社内LAN         DMZ:Webサーバ   TCP/443     許可2     社内LAN         インターネット  TCP/80,443  許可3     インターネット  DMZ:Webサーバ   TCP/443     許可4     インターネット  社内LAN         すべて      拒否5     すべて          すべて          すべて      拒否

1. It matches rule 3 and is allowed
2. It matches rule 1 and is allowed
3. Rule 2 is applied, and it is allowed
4. It matches rule 5 and is denied

A firewall has the rules shown in the table. Rules are evaluated in order from the top, and the action of the first matching rule is applied. Any traffic matching no rule is denied. When a device on the internet attempts a connection to the internal LAN's file server over TCP/445, how is it handled?

番号  送信元          宛先            サービス    動作------------------------------------------------------1     社内LAN         DMZ:Webサーバ   TCP/443     許可2     社内LAN         インターネット  TCP/80,443  許可3     インターネット  DMZ:Webサーバ   TCP/443     許可4     インターネット  社内LAN         すべて      拒否5     すべて          すべて          すべて      拒否

1. It matches rule 2 and is allowed
2. It matches rule 3 and is allowed
3. It matches rule 4 and is denied
4. No rule matches, so it is allowed by default

To block traffic from the IP address 203.0.113.9, identified as the source of an attack, to the DMZ web server, rule 3 in the table was added. Rules are evaluated in order from the lowest number, and the action of the first matching rule is applied. However, connections from that address continued even after the rule was added. Which of the following correctly identifies the cause and the fix?

番号  送信元            宛先            サービス  動作------------------------------------------------------1     すべて            DMZ:Webサーバ   TCP/443   許可2     社内LAN           インターネット  TCP/443   許可3     203.0.113.9       DMZ:Webサーバ   すべて    拒否4     すべて            すべて          すべて    拒否

1. Rule 1 matches first and allows the traffic, so rule 3 is never evaluated; move rule 3 to a position before rule 1
2. Rule 3 has the most specific condition and should be applied with priority, so the cause must be an equipment failure
3. It will eventually be blocked by the catch-all deny in rule 4, so the configuration is fine as it is
4. Rules 2 and 3 contradict each other, so deleting rule 2 will block the traffic

Which of the following is what a WAF (web application firewall) mainly protects against?

1. A business device becoming infected by malware run from an email attachment
2. Attacks such as SQL injection that exploit a vulnerability in a web application
3. An outsider entering the server room and taking equipment out
4. Eavesdropping on communication content by intercepting the radio signal of unencrypted Wi-Fi

Which of the following correctly explains the difference between an IDS and an IPS?

1. An IDS is dedicated to web applications, and an IPS is dedicated to protecting email
2. An IDS can only be installed on a device, while an IPS can only be placed on a network
3. An IDS is a mechanism for encrypting communication, while an IPS is a mechanism for decrypting encrypted communication
4. An IDS only detects unauthorized traffic and reports it, while an IPS blocks the traffic it detects

Which of the following correctly describes EDR?

1. It is placed at the network perimeter and blocks unnecessary traffic
2. It sits between users and a cloud service, making usage visible and controlling it
3. It runs an unknown file in an environment isolated from production to judge whether it is dangerous
4. It records the behavior of endpoints such as PCs and servers, detecting suspicious activity after an intrusion to support isolation and investigation

In defense in depth, measures are considered as entry-point measures, internal measures, and exit-point measures. Which of the following falls under an entry-point measure?

1. Inspecting the body and attachments of outgoing email for confidential information
2. Dividing the internal network by department so a server in one department cannot be reached directly from another
3. Recording each device's operation logs and periodically reviewing them for suspicious activity
4. Inspecting an incoming email's attachment in a sandbox before delivering it

Assuming a targeted attack has already breached the internal network, which of the following is the most appropriate internal measure?

1. Restrict outbound communication to go only through a proxy, and block traffic to suspicious destinations
2. Block suspicious email before users receive it, using a spam filter and attachment inspection
3. Use a firewall to block unnecessary traffic coming from outside into the company
4. Divide the internal network, require multi-factor authentication for access to important servers, and monitor device behavior

Which of the following is the most appropriate exit-point measure to prepare for a malware-infected device attempting to send internal information out to an attacker's server?

1. Periodically review the server room's entry and exit records for suspicious activity
2. Apply patches for the OS and business software as soon as they are released
3. Restrict outbound traffic to go only through a proxy, log it, and block traffic to suspicious destinations
4. Verify the result of sender domain authentication (SPF) on received email to identify forgery

Regarding the security of Wi-Fi used within a company, which of the following is appropriate?

1. Setting up MAC address filtering can prevent eavesdropping on communication content
2. Even with encryption disabled, hiding the SSID so it cannot be seen protects the content of the communication
3. WEP is highly compatible and secure, so it is still widely recommended today
4. WPA3 was standardized after WPA2 and has stronger encryption and authentication

Which combination correctly describes tailgating (piggybacking) in entry and exit control, along with its countermeasure?

1. Only an exit record being left with no entry record; prevented by synchronizing the time on entry and exit control devices
2. Entering by forging an ID card or borrowing someone else's; prevented by encrypting the information on the card to make copying difficult and by banning lending
3. Multiple users logging into the same device at the same time; prevented by introducing multi-factor authentication
4. An unauthenticated person following a legitimate user in through a door that person opened; prevented with anti-passback, a door structure that lets only one person through at a time, and employee training

Which of the following measures falls under a physical measure?

1. Keeping antivirus software's pattern file up to date
2. Locking the server room door and recording who enters and exits
3. Carrying out information security training for employees
4. Setting a password for a user ID

Which of the following correctly describes the tamper resistance required of something like an IC card?

1. The property of automatically switching to a backup system when a failure occurs, continuing processing without stopping
2. The property of encrypting the content of an exchange to prevent eavesdropping or reading the content while it is in transit
3. The property of becoming unable to operate, among other responses, if someone tries to unlawfully read out internal information, making analysis difficult
4. The property of protecting internal equipment and preserving operation even when a power abnormality such as a lightning strike or an outage occurs

Which of the following is the most appropriate way to manage portable media such as USB drives?

1. Just to be safe, leave data that was taken out on the medium even after it has been returned
2. Require an application and approval for taking one out, record it in a log, and encrypt the data stored on it
3. As long as the data is encrypted, no application or record is needed for taking it out
4. Prioritize efficiency and let personal USB drives be freely used on business PCs without any application

Which of the following is the most appropriate way to dispose of a paper document containing personal information?

1. Throw it out as-is together with general trash
2. Reuse it internally as scratch paper, since the back side is blank
3. Keep it in a collection box for a long period and put it out once a month together with combustible trash
4. Shred it or reliably dispose of it by outsourcing it for pulping

A company carries out the following measures (a) through (d). Which of the following lists exactly the ones that fall under physical measures? (a) Installing security cameras in the office. (b) Storing important documents in a lockable cabinet. (c) Encrypting the data on a USB drive. (d) Retaining entry and exit records for a set period.

1. (a), (c)
2. (a), (b), (c), (d)
3. (b), (c), (d)
4. (a), (b), (d)

Which of the following is the most appropriate way of thinking about managing an office by dividing it into zones such as reception, the general office, and the server room?

1. Impose stricter authentication for zones holding more important information assets, narrowing who may enter the further in one goes
2. Let both visitors and employees move along the same route, to reduce the effort of guiding and escorting people
3. Post signs in the building's corridors so visitors can easily find the server room's location
4. Leave the general office unlocked and it is enough to lock only the server room

The table shows access rights configured for a company's business system. The HR staff member registers and updates HR information; the payroll staff member handles payroll calculation (which requires viewing HR information); the sales staff member and the sales clerk (a temporary worker) enter orders; and the sales department handles neither HR nor payroll information. Which of the following settings should be revised in light of the principle of least privilege?

利用者（役割）    人事DB    給与DB    受注DB    全社共有--------------------------------------------------------人事担当者        更新可    不可      不可      参照可給与担当者        参照可    更新可    不可      参照可営業担当者        不可      不可      更新可    参照可営業事務（派遣）  参照可    不可      更新可    参照可

1. That the sales clerk (temporary) has view access to the HR database
2. That the sales staff member has update access to the order database
3. That the HR staff member has update access to the HR database
4. That the payroll staff member has view access to the HR database

The table shows the access rights currently granted to Tanaka in the HR department. Tanaka is transferring to the sales department this month, where the job will involve entering orders and preparing documents shared within the sales department. Which of the following is the most appropriate way to configure access rights after the transfer?

対象システム          現在の権限--------------------------------人事DB                更新可給与DB                参照可受注DB                不可部内共有（人事部）    更新可部内共有（営業部）    不可

1. For the handover, keep view access to the HR database for one year, and additionally grant update access to the order database and the sales department's shared folder
2. Leave the current settings unchanged until Tanaka submits a request
3. Revoke access to the HR database, the payroll database, and the HR department's shared folder, and grant update access to the order database and the sales department's shared folder
4. Leave the current settings as they are, and additionally grant update access to the order database and the sales department's shared folder

The table lists the access rights to the payroll database. Only HR department staff in charge of payroll calculation use the payroll database for work. In an annual review, which of the following lists exactly the rights that should be removed?

利用者  所属・担当            給与DBの権限    最終ログイン----------------------------------------------------------A       人事部（給与計算）    更新可          08-18B       営業部（受注入力）    参照可          01-10C       人事部（給与計算）    参照可          08-15D       退職済み              参照可          03-20

1. D only
2. B and D
3. A, B, and D
4. A and C

Which of the following is the most appropriate way to manage a system's privileged account (an account with administrator rights)?

1. For efficiency, have all administrators share a single account, including its password
2. Require an application and approval for each use, and keep a record of checkout, return, and the operations performed
3. To save the effort of switching, log in with the privileged account even for ordinary daily work
4. Since only trusted staff use the privileged account, skip capturing operation logs

Which of the following is the most appropriate way to capture and retain access logs?

1. Aggregate them onto a separate log server, store them in a form that cannot be altered, and review the content periodically
2. Leave the time setting on each device to the judgment of whoever is in charge of that device
3. Let an administrator freely edit the captured logs whenever needed
4. Deliberately exclude records of failed login attempts to save on storage capacity

Regarding how to prioritize applying patches across a large number of systems, which of the following is most appropriate?

1. Skip verifying operation in a test environment, and apply the patch to every system at once the same day it is published
2. Prioritize a vulnerability where exploitation has actually been confirmed and which affects a server exposed to the internet
3. Apply them in order starting from the system with the fewest users, leaving the most-used system for last
4. Mechanically apply them in order from the oldest publication date

Which of the following is the most appropriate problem with the practice (sometimes called PPAP) of attaching a password-protected ZIP file to an email and then sending the password to the same recipient in a separate email immediately after?

1. The password for a ZIP file is limited to 8 characters, making it impossible to set a sufficiently strong password
2. The recipient must separately purchase and install paid, dedicated software to extract the file
3. Because a ZIP file has a low compression ratio, the volume of email traffic increases considerably, raising the load on the internal mail server
4. Because the file and the password travel over the same channel, it is weak against eavesdropping or misdirection, and encryption prevents the receiving side from running a virus scan

Which of the following is the most appropriate countermeasure against an information leak from a misdirected email?

1. When sending to many recipients at once, list them all in the To field so everyone can see who else received it
2. Use a mechanism that holds a message for a few minutes before sending, and use that time to check the recipients and attachments
3. Leave the recipient entry to the autocomplete feature and skip checking before sending, to send it quickly
4. If a misdirected email is noticed, wait and see for a while without telling the recipient

Regarding managing the sharing scope of cloud storage used for business, which of the following is most appropriate?

1. Keep using the default sharing scope and review it only if a problem occurs
2. Check the sharing scope when a file is created, and periodically take inventory to revoke unnecessary exposure
3. Since internal regulations prohibit sharing outside the company, there is no particular need to check the sharing settings
4. Setting it to “anyone with the link” is safe, because someone who does not know the URL cannot view it

The following (a) through (c) were carried out as information-leak countermeasures. Which combination correctly classifies each as human, technical, or physical? (a) A regulation banning business use of personal USB drives was established and communicated to all employees. (b) The USB ports on business PCs were disabled through configuration. (c) Important documents were decided to be stored in a lockable cabinet.

1. (a) Physical, (b) Technical, (c) Human
2. (a) Human, (b) Physical, (c) Technical
3. (a) Human, (b) Technical, (c) Physical
4. (a) Technical, (b) Human, (c) Physical

Which of the following is the most appropriate way for a user to manage their own password?

1. Since mixing in symbols is enough to be safe, a short password under 8 characters that is easy to remember can be set
2. Use a different, long passphrase for each service, and if they cannot all be remembered, use an approved password manager
3. So it is not forgotten, reuse the same password across every service and never change it
4. So it is not forgotten, write it on a sticky note and put it at the edge of the screen

An email arrives claiming to be from a bank, stating, “Your account will be suspended. Please check the link below immediately.” Which of the following is the most appropriate response for the user?

1. Open the link and judge based on whether the design of the displayed page looks the same as the real one
2. Since the Japanese wording is natural and error-free, judge it to be genuine and enter the ID and password on the linked page
3. Without using the link in the email, check the situation through the bookmark or official app already in regular use
4. Contact the phone number written in the email and follow that person's instructions

Regarding precautions when using public Wi-Fi for business while out of the office, which of the following is most appropriate?

1. It can also be used to log into internal company systems, as long as the session is kept short
2. Enabling automatic connection avoids dangerous access points
3. Even unencrypted public Wi-Fi is safe if the SSID matches the name of the shop
4. Go through a VPN the company has provided, or use a smartphone's tethering

Which of the following is the most appropriate way to manage a smartphone used for business?

1. A calculator app requests permission to access contacts, and it is granted because it is convenient
2. An app distributed somewhere other than the official app store is installed and used because users have given it good reviews
3. Since an OS update could make behavior unstable, postpone applying it for now and continue business on the version currently in use
4. Set a screen lock, install apps only from the official store, and check whether a requested permission is reasonable in light of the app's function

Voices from the field say, “The information security regulations are too strict and work cannot get done.” Which of the following is the most appropriate response for the information security leader?

1. Leave it to the field's own judgment whether to apply the regulation, allowing it to be skipped whenever it feels unworkable
2. Decide not to punish violations, while leaving the regulation's current content unchanged
3. Listen to how work actually happens, consider whether the procedure can be simplified while keeping the level of risk unchanged, and revise the regulation if needed
4. Since regulations exist to be followed, ignore the feedback from the field and instruct that they be enforced strictly

For working from home, the following (a) through (c) were carried out. Which combination correctly classifies them as human, technical, or physical measures? (a) The administrator password on the home Wi-Fi router was changed from its default value. (b) A privacy filter was applied to the display. (c) A regulation banning family members from using the business PC was established and communicated to all employees.

1. (a) Technical, (b) Human, (c) Physical
2. (a) Physical, (b) Technical, (c) Human
3. (a) Human, (b) Physical, (c) Technical
4. (a) Technical, (b) Physical, (c) Human