問28
頻出度★★★
アクセス管理者は, 不正アクセスからコンピュータを防御する役割を担う。不正アクセス禁止法において, アクセス管理者が実施するよう努力すべきこととして定められている行為はどれか。
平成27年度 秋期 ITパスポート試験 問28
ストラテジ系法務 › セキュリティ関連法規
This question's explanation and your answers so far.
解説
問 28
- ア
正解 The Unauthorized Access Prohibition Act requires the access administrator, as a duty of effort, to take 'defensive measures' to protect a specified computer from unauthorized access. Specifically, this means properly managing identification codes (user IDs and passwords) and constantly verifying the effectiveness of the access control function, taking measures such as enhancing that function when necessary. Choice ア, 'verify the effectiveness of the access control function,' corresponds exactly to the duty of effort defined by this provision, so it is correct.
Incorrectイ
The Unauthorized Access Prohibition Act does not impose on the access administrator any obligation to periodically submit access logs to a supervising authority. What the Act requires is the administrator's own defensive measures, not reporting or submission to a government agency, so this is wrong.
Incorrectウ
Continuous monitoring by multiple personnel is a common practice in security operations, but it is not an action that the Unauthorized Access Prohibition Act defines as the access administrator's duty of effort, so this is wrong.
Incorrectエ
Periodically changing passwords is sometimes done as a security measure, but what the Act stipulates is 'proper management' of identification codes; it does not prescribe the specific act of periodic changes as a duty of effort. It is confusing because it relates to passwords, but it does not match the wording of the provision, so this is wrong.
ここがポイント
- Under the Unauthorized Access Prohibition Act, the access administrator's defensive measures are a 'duty of effort,' whose pillars are proper management of identification codes (such as passwords) and verifying the effectiveness of the access control function while taking necessary measures.
- Distinguish that specific practices such as an obligation to report to a supervising authority or periodically changing passwords are not part of the duty of effort defined by this Act.
用語