問68
頻出度★★★
情報セキュリティにおけるリスクアセスメントの説明として, 適切なものはどれか。
平成30年度 秋期 ITパスポート試験 問68
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 68
Incorrectア
Removing a virus that has infiltrated a PC or server is a response to an event that has actually occurred (virus protection, incident response), not risk assessment, which analyzes and evaluates risk.
- イ
正解 Risk assessment refers to a series of activities that analyze the risks to identified information assets, evaluate their magnitude against a set of criteria, and judge whether a response (risk treatment) is necessary. Choice イ describes exactly this flow (analyzing and evaluating the risks to identified assets and judging against criteria whether a response is necessary), so it is an appropriate description of risk assessment.
Incorrectウ
Using pre-registered information to confirm that a user is who they claim to be is a description of “authentication (identity verification)”, not an activity that evaluates risk.
Incorrectエ
Calculating cost-effectiveness when introducing an information system is a cost-benefit analysis for investment decisions, which differs from risk assessment that analyzes and evaluates the risks to assets.
ここがポイント
- Risk assessment = a series of activities made up of risk analysis (grasping the magnitude of risk) plus risk evaluation (judging against criteria whether a response is needed).
- Distinguish that risk assessment is a separate concept from responding to actual events (such as removing viruses), authentication, and cost-effectiveness calculation.
用語