Related Fields (Technology, Management, Strategy)

A firewall should allow only traffic connecting from inside the company to an external website over HTTPS. Which destination port number should be allowed?

1. 80
2. 443
3. 23
4. 25

An internal network was divided into subnets by department, with communication between subnets controlled by a router. What is the main aim of this measure?

1. To encrypt all communication crossing between subnets, so its content cannot be read even if intercepted in transit
2. To assign the same IP address to every internal device at once, greatly reducing the effort of address management
3. To block all unauthorized access from the outside internet at the perimeter, so no internal device can ever be breached
4. So that even if one device is infected with malware, the damage stays contained within its zone and the communication can be blocked at the boundary

Internal devices are assigned private IP addresses and connect to the internet through NAPT translation to a global IP address. Which of the following is the most appropriate description of this setup?

1. The main purpose of NAPT is conserving global IP addresses; controlling communication from outside must be handled separately with a firewall
2. Using NAPT automatically encrypts communication content, making a VPN unnecessary
3. Because NAPT is a mechanism that hides the source address, unauthorized communication from inside to outside is also automatically blocked entirely
4. As long as internal devices use private IP addresses, they cannot be reached directly from outside, so they can never become infected with malware

A remote employee connects from home to the company system over a VPN. Which of the following most appropriately describes a VPN?

1. A VPN encrypts and protects the communication path, but it does not guarantee that the connecting device itself is safe, so measures on the device side are also needed
2. Using a VPN automatically encrypts files stored on the connecting device
3. As long as the communication path is encrypted with a VPN, an infection on the connecting device cannot affect the internal company systems
4. A VPN is a physical dedicated line that does not use the internet and does not pass through a telecommunications carrier's facilities

Regarding security measures for an office's Wi-Fi, which of the following is most appropriate?

1. Use WPA2 or WPA3 for encryption and authentication, and treat SSID stealth and MAC address filtering as merely supplementary measures
2. As long as MAC address filtering is configured, no other measures, including encryption, are needed
3. Connect the guest Wi-Fi and the internal business Wi-Fi to the same network, and manage the access point equipment and settings together centrally
4. Enabling SSID stealth to hide the SSID from outsiders is enough to make WEP sufficiently safe as the encryption method

To reduce damage from spoofed email impersonating the company's own domain, sender domain authentication is being introduced. Which of the following most appropriately describes SPF, DKIM, and DMARC?

1. DMARC is a mechanism that encrypts the body of an email so its content cannot be read by a third party in transit.
2. SPF is a mechanism for verifying an electronic signature, DKIM is a mechanism that publishes the IP addresses of authorized sending servers in DNS for comparison, and DMARC is a mechanism where the sending side publishes a policy for how to handle email that fails authentication.
3. SPF is a mechanism that publishes the IP addresses of authorized sending servers in DNS for comparison, DKIM is a mechanism for verifying an electronic signature, and DMARC is a mechanism that publishes a policy for how to handle email that fails authentication.
4. All three only need to be configured on the receiving mail server; nothing needs to be configured on the sending domain.

Internal servers and network equipment are synchronized to an NTP server to keep their clocks aligned. Which of the following is the most appropriate reason this matters for information security?

1. Because it makes it possible to cross-reference logs from multiple devices in chronological order, accurately tracing the course of an incident and preserving their value as an audit trail
2. Because having the clocks aligned automatically encrypts communication so it cannot be eavesdropped on
3. Because having the clocks aligned makes it possible to predict in advance the time malware will start acting, so communication at that time can be blocked beforehand
4. Because having the clocks aligned shrinks the size of the log files output by each device, extending how long logs can be retained on the same equipment

A company built its business server using IaaS. In light of the shared responsibility model, which of the following is something the user should do?

1. Carry out patching of the guest OS and middleware they themselves installed, as the user's own planned responsibility
2. Carry out vulnerability countermeasures and patching for the virtualization platform (hypervisor) itself, as the user's own planned responsibility
3. Carry out entry and exit control and physical security for the data center by physically visiting the site themselves, including keeping records of it
4. Travel to the data center and personally carry out parts replacement when physical server hardware fails

A SaaS file-sharing service used for business had its sharing scope set by a staff member to “anyone with the link,” leaving a confidential file viewable from outside the company. Which of the following is the most appropriate explanation in light of the shared responsibility model?

1. In SaaS, the service provider is supposed to protect everything, so this event is also the provider's responsibility
2. The sharing-scope setting while using SaaS is automatically optimized by the service provider, so neither the user nor the provider bears responsibility
3. Setting access rights and the sharing scope, and managing the data placed there, fall within the user's area of responsibility, so this is the user's responsibility
4. Because SaaS gives the user no authority over sharing settings, this kind of situation cannot occur

A company runs a business application it developed in-house on top of PaaS. If a SQL injection vulnerability is found in this application, which of the following is the most appropriate response?

1. Since this is a vulnerability in the OS itself, address it by having the user apply a patch to the guest OS
2. Since the application developed in-house falls within the user's area of responsibility, fix the program in-house
3. Since PaaS does not let a user develop an application, this vulnerability cannot occur
4. Since this is a problem with the runtime environment provided by the PaaS provider, simply wait for a fix from the provider

Device A, with an availability of 0.95, and device B, with an availability of 0.90, are connected in series so that the whole system operates only when both A and B are operating. What is the overall system's availability? Assume the failures of A and B are independent of each other.

1. 0.990
2. 0.855
3. 0.900
4. 0.925

Two devices, each with an availability of 0.90, are set up in a redundant configuration where the overall system operates as long as either one is operating. What is the overall system's availability? Assume the failures of the two devices are independent of each other.

1. 0.90
2. 0.95
3. 0.81
4. 0.99

A file server's disks are configured as RAID 1 (mirroring). Which of the following is the most appropriate evaluation of this as a countermeasure against ransomware?

1. RAID 1 is effective against a disk failure, but because encryption is reflected onto both disks, generational backups also need to be kept offline or at a remote location
2. Expanding RAID 1 to a five-disk configuration would prevent ransomware damage
3. RAID 1 is a mechanism that always prohibits writing to the disk, so even if ransomware tries to encrypt a file, it cannot rewrite it and no damage occurs
4. With RAID 1, even an encrypted file can be automatically restored from the content of the other disk, so no additional measure such as taking backups is particularly necessary

An HR database's employee table has columns for employee number, name, department, title, salary, and individual number. General employees should be able to reference only name, department, and title, as an employee directory. Which of the following is the most appropriate method?

1. Define a view that pulls out only the name, department, and title columns, and grant view access only to that view for general employees
2. Grant view access to the employee table itself to all employees, and tell everyone internally not to look at the salary and individual number columns
3. Change the employee table so all employees can update it, and operate it with the salary and individual number columns left permanently blank
4. Place a backup of the employee table in a shared folder for everyone to find and use the information they need from there

A database server's disk failed and became unusable, and it was replaced with another disk. A backup from the previous night and the after-image log taken since then are both available. Which method restores the system to the state immediately before the failure occurred?

1. Restore only the backup, and resume operation from the state as of the previous night
2. Restore the backup and then perform a roll-forward that applies the after-image log
3. Recover by performing only a rollback that undoes a transaction that was interrupted mid-process
4. Use only the before-image log to go back to a state earlier than when the backup was taken

In developing a new business system, which approach follows the idea of security by design?

1. Go back to the design stage only when a vulnerability is found during testing, considering and adding whatever security measure is needed at that point
2. Since security is work for operations staff, give it no consideration whatsoever, whether as a requirement or in the design, during the development phase
3. Define security requirements such as how access rights are divided, the scope of logs to capture, encryption, and the authentication method at the planning and requirements-definition stage
4. Prioritize implementing functionality first and proceed with development, adding necessary security functions one by one after the system goes live

Which of the following most appropriately describes penetration testing carried out before a web system is published?

1. A test that examines the program's internal structure to confirm that every branch of its logic is executed at least once, measuring quality by degree of coverage
2. A test that actually attempts an intrusion from an attacker's standpoint to check whether the defenses can be broken through, requiring the prior consent of the target system's administrator to carry out
3. A test that checks, from the outside without looking at the program's internal structure, whether the output matches the specification for a given input, also doubling as an assessment of intrusion possibility as a final check before release
4. A test that has actual users operate the system to evaluate how clear and easy to use the screens are

In service management, which of the following most appropriately describes the difference between incident management and problem management?

1. Incident management aims to identify the root cause and prevent recurrence, while problem management aims to restore the service to its normal state as quickly as possible
2. Incident management aims to restore the service to its normal state as quickly as possible, while problem management aims to identify the root cause and prevent recurrence
3. Incident management deals only with information-security-related incidents, and problem management deals with every other kind of failure or incident — a distinction by scope
4. Incident management and problem management refer to exactly the same activity, sharing the same subject, purpose, and procedure, differing only in what they are called in a report

When outsourcing the operation of a business system, an SLA is agreed upon. Which of the following most appropriately describes an SLA?

1. An SLA is a document in which the provider and the user agree on numeric service quality levels, defining not only uptime and target recovery time but also security matters such as the reporting deadline in the event of an incident and the log retention period
2. An SLA is an internal regulation of the service provider and is not to be disclosed to the user
3. An SLA should record only availability-related targets such as uptime and target recovery time, and must never record security-related matters such as the reporting deadline in the event of an incident or the log retention period
4. Once agreed upon, an SLA must never be reviewed, and achievement against it is not measured during the contract period either

Which combination most appropriately describes change management and configuration management in service management?

1. Change management is the activity of serving as a single contact point that accepts inquiries and failure reports from users, and configuration management is the activity aimed at restoring the service from an occurred failure as quickly as possible
2. Change management is the activity of identifying the root cause of a failure, and configuration management is the activity of securing the processing capacity needed for business
3. Change management is the activity of evaluating the impact of a change to a system, obtaining approval, and then carrying it out and recording it; configuration management is the activity of continuously and accurately keeping track of configuration items such as equipment, software, and settings, and the relationships among them
4. Change management is the activity of an auditor instructing the audited department to make improvements, and configuration management is the activity of management deciding whether to make an investment

A company has decided to carry out a systems audit internally. From the standpoint of the systems auditor's independence, which of the following is most appropriate?

1. An internal audit department staff member who is organizationally independent of the audited department, or an outside auditor, carries out the audit
2. The head of the department being audited audits their own department's work and creates and submits the audit report
3. An operations staff member in the information systems department audits the very business system they operate day to day
4. The project leader who was in charge of developing the audited system audits that system themselves

Regarding an audit trail and follow-up in a systems audit, which of the following most appropriately describes them?

1. An audit trail is the audit report itself created by the auditor, which is not disclosed to the audited department to maintain independence, and in follow-up the audited department evaluates its own improvement status and closes it out
2. An audit trail is a mechanism or set of records that lets processing be traced back after the fact, showing when, by whom, and how it was carried out; in follow-up, the auditor confirms the status of improvement on the raised findings
3. An audit trail is only captured during the audit period and can be skipped during normal operation
4. In follow-up, the auditor devises and carries out the improvement measures themselves, resolving the issue

Which of the following most appropriately describes the role of a CISO at a company?

1. Drawing up sales and pricing strategy for the company's own products, and being responsible for achieving sales targets
2. Preparing financial statements and being responsible for explaining accounting matters at the shareholders' meeting
3. Being responsible for formulating the information security policy, deciding the risk-treatment policy, directing the response to an incident, and reporting to management
4. Personally carrying out the setup and wiring of internal PCs and network equipment, and handling day-to-day maintenance and responding to failures

From the standpoint of internal control, which of the following practice follows the idea of segregation of duties?

1. Separating the staff member who places a purchase order from the one who inspects the delivered goods
2. Prioritizing efficiency and also granting the system development staff the authority to change the production environment
3. Granting every employee administrator rights so anyone can carry out whatever task is needed
4. Having one staff member consistently carry out everything from application through approval, execution, and recording, to make responsibility clear

Which of the following most appropriately describes the procurement flow when ordering a business system from an outside vendor?

1. Request for Information (RFI) → Request for Proposal (RFP) → receiving and evaluating proposals → contract
2. Contract → Request for Proposal (RFP) → receiving and evaluating proposals → Request for Information (RFI)
3. Request for Proposal (RFP) → Request for Information (RFI) → contract → receiving and evaluating proposals
4. Receiving and evaluating proposals → Request for Information (RFI) → contract → Request for Proposal (RFP)

A company is outsourcing work involving customers' personal data. Regarding selecting and managing the contractor, which of the following is most appropriate?

1. Even if the contractor further subcontracts to yet another business operator, there is no need to inform the outsourcing party
2. It is enough to select the vendor with the best price and delivery time; certification status, security matters, and arrangements for an incident can be discussed after the contract is signed
3. Once the work is outsourced, responsibility for managing the personal data fully shifts to the contractor, and the outsourcing party steps entirely away from managing or supervising it after selection
4. Spell out in the selection criteria and contract things such as certification status, how subcontracting will be handled, the obligation to report an incident, accepting an audit, and erasing data at the end of the engagement, and continue to receive periodic reports and supervise even after outsourcing

An employee has asked to use a generative AI service for work. From the standpoint of preventing an information leak, which rule should the organization establish?

1. Since entered content is always deleted by the provider, let confidential information be entered freely too
2. Since generative AI is dangerous, ban its use on internal devices across the board, but leave use through a personal device or personal account to each individual's own judgment
3. Let each employee freely choose whatever generative AI service they personally prefer, and let them freely enter any work data into it without restriction
4. Limit usable services to ones the organization has approved, and explicitly state in the rules that customer personal information and unpublished management information must not be entered

A generative AI was used to draft an explanatory document intended for release outside the company. Which of the following is the most appropriate way to handle this draft?

1. Because generative AI can output plausible-sounding content that is not factual, and its output may resemble an existing copyrighted work, have a person verify the facts and check the rights situation before publishing it
2. As long as a source is cited, it can be published as-is without fact-checking the content
3. Because generative AI output is based on a huge volume of training data, its content is always accurate and never resembles an existing copyrighted work, so it can be published as-is without checking
4. Because text created by generative AI can never raise a copyright problem, checking the rights situation is unnecessary

For a certain information asset, the loss from an incident is estimated at 20 million yen per occurrence, with an annual probability of 10%. Which of the following is the most appropriate way of thinking, from a management standpoint, about the cost of a countermeasure to prevent this incident?

1. The expected annual loss comes to 2 million yen, so this should be compared against the countermeasure's annual cost to judge whether the investment is worthwhile — except that anything involving human life or legal compliance should not be decided on cost-effectiveness alone
2. The expected annual loss comes to 2 million yen, but regardless of the amount, the cost of the countermeasure should always be set at the full 20 million yen, the same as the per-occurrence loss, without considering cost-effectiveness
3. As long as the probability of occurrence is not 100%, the incident can be treated as not happening, so no countermeasure is needed
4. Since security measures are a cost that generates no revenue, no cost should be spent on them at all

To report the state of information security efforts to management in numeric form, a KGI, CSF, and KPI are set. Which combination is most appropriate?

1. The KPI is a secret indicator known only to management and is not shown to the department in charge
2. Set the KGI as “zero major incidents,” the CSF as “raising security awareness across all employees,” and the KPI as things like “the drill's open rate” or “the average number of days to fix a vulnerability”
3. KGI, CSF, and KPI are all ultimate outcome indicators, so the same content is written three times to express them
4. Set the KGI as “a targeted-attack email drill open rate of 5% or below,” the CSF as “repeating the drill every year,” and the KPI as “bringing the number of major incidents to zero”