問83
頻出度★★★
ISMS における情報セキュリティリスクの特定に関する記述において，a，b に入れる字句の適切な組合せはどれか。 ISMSの ［ a ］ における情報の機密性，［ b ］ 及び可用性の喪失に伴うリスクを特定する。
平成29年度 春期 ITパスポート試験 問83
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 83
Incorrectア
Blank b, integrity, is correct as one of the three key elements, but blank a, outside the scope of application, is wrong. Risk identification is carried out on the information assets within the ISMS scope of application, so a should be within the scope of application.
Incorrectイ
Both blank a, outside the scope of application, and blank b, vulnerability, are wrong. The correct answer for a is within the scope of application, and the answer for b is integrity, one of the three key elements. A vulnerability is a weakness that gives rise to risk, not a property to be protected on a par with confidentiality and availability.
- ウ
正解 The correct answer is ウ (a: within the scope of application, b: integrity). In an ISMS risk assessment, you first look at the information assets that lie within the ISMS scope of application and identify the risks present there. Information outside the scope is not an object of management, so a should be within the scope of application. The three key elements of information security (CIA) are confidentiality, integrity, and availability; since the statement already gives confidentiality and availability, the remaining blank b must be integrity. Therefore the combination a = within the scope of application, b = integrity is correct.
Incorrectエ
Blank a, within the scope of application, is correct, but blank b, vulnerability, is wrong. What should be listed alongside confidentiality and availability is integrity, the remaining one of the three key elements of information security; a vulnerability does not belong here.
ここがポイント
- The three key elements of information security (CIA) are confidentiality, integrity, and availability. If confidentiality and availability are given, you can deduce that the remaining one is integrity.
- In an ISMS, risk identification (risk assessment) is performed on the information assets within the defined scope of application.
用語