問89
頻出度★★★
A社では，自社の情報資産に関するリスク分析を実施した結果，近くの川が氾濫することで会社の1階にあるサーバルームが浸水するおそれがあることが分かった。サーバルームの移転も検討したが，川は100年前に1度氾濫したきりで，その可能性はほとんどないと判断し，特に対策は講じないことを経営層が決定した。A社が選択した情報セキュリティのリスク対応はどれか。
平成28年度 秋期 ITパスポート試験 問89
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 89
Incorrectア
“Risk transfer” means shifting the burden of loss caused by a risk to a third party, for example by taking out insurance or outsourcing operations. In this question the company did not take any action such as buying insurance to shift the loss to another party; it merely decided to take no countermeasures, so this does not apply.
Incorrectイ
“Risk avoidance” means eliminating the risk itself by stopping or moving away from the very activity that causes it. Relocating the server room would be an example of avoidance, but in this question relocation was considered and then rejected rather than carried out, so it is not the treatment that was chosen.
- ウ
正解 The correct answer is “ウ Risk acceptance.” Risk acceptance means: after evaluating the likelihood and impact of a given risk and weighing the cost of countermeasures against the residual risk, deliberately choosing not to take any additional countermeasures and accepting the risk. In this question, after analyzing the flooding risk of the server room being submerged, although relocation was considered as a countermeasure, management judged that the river had flooded only once, 100 years ago, and that the likelihood was almost nil, and so “decided not to take any particular countermeasures.” Because the company recognizes that the risk exists but accepts it without taking countermeasures, this corresponds to risk acceptance (risk retention).
Incorrectエ
“Risk reduction” means taking countermeasures to lessen the likelihood or the magnitude of the impact of a risk (for example, waterproofing measures or installing the servers on an upper floor). In this question the company decided to “take no particular countermeasures,” so it did not take any measure to lower the risk, and this does not apply.
ここがポイント
- The four categories of risk treatment — avoidance (remove the cause), reduction (lower the probability or impact), transfer (shift the loss burden to a third party via insurance, etc.), and acceptance (accept without countermeasures) — should be clearly distinguished.
- The key point of this question is that deciding to accept a risk — recognizing it but deliberately taking no additional countermeasures because, for instance, its likelihood is extremely low — is “risk acceptance (risk retention).”
用語