問67
頻出度★★★
情報セキュリティの要素である機密性, 完全性及び可用性のうち, 完全性を高める例として, 最も適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問67
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 67
- ア
正解 The correct answer is ア. Integrity means the property of keeping information accurate and complete, with no errors or tampering. When entering data, the person who did the entry tends to overlook mistakes in their own work because of preconceptions, so having a third party other than the person who entered the data cross-check the entered results (double-checking, verify entry) makes it possible to find and correct entry mistakes or unauthorized alterations. This is a measure that guarantees the correctness of the data itself, so it is the most appropriate example of enhancing integrity.
Incorrectイ
Encrypting data when saving it to external media is a measure to prevent a third party from reading the contents even if the media is lost or stolen. What it protects is keeping the data unseen, so it is an example of enhancing confidentiality, and it does not directly contribute to whether the data content is correct (integrity).
Incorrectウ
Adding a backup power supply (a UPS or an in-house generator) is a measure that lets the system keep running and stay usable even during a power outage. This is an example of availability, which protects being usable when needed, not of integrity.
Incorrectエ
Setting a read password on a file is access control to keep people without authorization from opening the file, so it is an example of enhancing confidentiality. Note that a write (update) password would relate to integrity as a measure against tampering, but this choice is a read password, so it does not apply.
ここがポイント
- The three elements of information security (CIA): confidentiality = only authorized people can view the information; integrity = the information is accurate, with no tampering or errors; availability = it can be used when needed. Sort each measure by which element it protects.
- Typical measures that enhance integrity include double-checking, verify entry, check digits, tamper detection using hash values, and restricting access rights (update rights) — all of them guarantee the correctness of the data.
用語