問78
頻出度★★★
情報セキュリティ対策において, 情報を保護レベルによって分類して管理するとき, 管理方法として, 適切なものだけを全て挙げたものはどれか。 a 情報に付与した保護レベルは, 廃棄するまで変更しない。 b 情報の取扱い手順は, 保護レベルごとに定める。 c 情報の保護レベルは, 組織が作成した基準によって決める。 d 保護レベルで管理する対象は, 電子データとそれを保存した保存媒体に限定する。
平成30年度 秋期 ITパスポート試験 問78
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 78
Incorrectア
The combination a, c. c is correct, but a, “The assigned protection level is never changed until it is discarded”, is wrong. The value and confidentiality of information can fall (or rise) as time passes or circumstances change, so an operation that allows periodic review and re-classification is preferable; a fixed operation that makes no change at all until disposal is inappropriate.
Incorrectイ
The combination a, d. Both a (never changing it until disposal) and d (limiting the objects to electronic data and storage media) are inappropriate, and it contains not a single correct statement.
- ウ
正解 When classifying and managing information by protection level, the appropriate management methods are b and c, so the correct answer is “ウ (b, c)”. Statement b, “Handling procedures for information are defined for each protection level”, is exactly the aim of classified management—the higher the level, the stricter the storage, handover, and disposal procedures imposed—so it is appropriate. Statement c, “The protection level of information is decided according to criteria created by the organization”, means the classification does not vary by each person’s subjective judgment but follows a unified standard set by the organization, so it is appropriate. The only combination that includes both of these while excluding the inappropriate a and d is “ウ”.
Incorrectエ
The combination b, d. b is correct, but d, “The objects managed by protection level are limited to electronic data and the storage media on which it is saved”, is wrong. Paper documents, printed materials, and information conveyed orally are also objects that should be managed according to their protection level, so limiting it to electronic data is inappropriate.
ここがポイント
- In classified (protection-level) management of information assets, the basic principle is that levels are decided by a unified standard set by the organization, and handling procedures are defined for each level.
- Protection levels should be reviewable (re-classifiable) as their value and confidentiality change, and the objects of management should not be limited to electronic data but include all forms such as paper documents and oral information.
用語