問84
頻出度★★★
社員に対する情報セキュリティ教育の実施に関する記述 a～d のうち, 適切なものだけを全て挙げたものはどれか。 a 情報セキュリティ違反をした者に対する再教育に当たっては, 同じ過ちを繰り返さないための予防処置も含める。 b 新入社員に対する研修プログラムに組み込む。 c 対象は情報システム部門に所属する社員に限定する。 d 定期的な実施に加えて, 情報セキュリティに関わる事件や事故が発生した後にも実施する。
平成27年度 秋期 ITパスポート試験 問84
This question's explanation and your answers so far.
解説
問 84
- ア
正解 Information security education should fundamentally target all employees and be carried out continuously and according to the situation, even in normal times. Evaluating each statement: a says that when re-educating a violator, preventive measures to keep them from repeating the same mistake should also be included, which is appropriate from the standpoint of preventing recurrence; b incorporates it into the training program for new employees, which is appropriate because it instills security awareness from the time they join; d conducts it after an incident or accident occurs in addition to periodic implementation, which is appropriate for reflecting lessons learned and preventing recurrence. Therefore the appropriate statements are the three a, b, and d, and choice ア, which lists only these, is correct.
Incorrectイ
This is 'a, c, d', but c limits the target of education to employees in the information systems department, which is inappropriate. Information security is a matter that involves all employees, so the target should not be narrowed to a single department. In addition, this option omits the appropriate b, so it is wrong.
Incorrectウ
This option lists only 'a, d', but b, which incorporates it into new-employee training, is also appropriate, and since this option does not include b, it does not amount to listing all of the appropriate items. There is an omission, so it is wrong.
Incorrectエ
This is 'b, c', but c contains the inappropriate statement of limiting the target to the information systems department. Furthermore, the appropriate a and d are omitted, so it does not form a combination that lists only all of the appropriate items, and it is therefore wrong.
ここがポイント
- The target of information security education is all employees rather than a specific department; limiting the target to a single department such as the information systems department is inappropriate.
- As for timing, it is desirable to carry it out in multiple ways, such as incorporating it into new-employee training, conducting it periodically, conducting it after an incident or accident occurs, and re-educating violators (including preventive measures).
用語