問99
頻出度★★★
ISMSにおける情報セキュリティリスクアセスメントでは，リスクの特定，分析及び評価を行う。リスクの評価で行うものだけを全て挙げたものはどれか。 a あらかじめ定めた基準によって，分析したリスクの優先順位付けを行う。 b 保護すべき情報資産の取扱いにおいて存在するリスクを洗い出す。 c リスクが顕在化したときに，対応を実施するかどうかを判断するための基準を定める。
平成30年度 秋期 ITパスポート試験 問99
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 99
- ア
正解 Risk assessment consists of three stages: risk identification → risk analysis → risk evaluation. Risk evaluation is the stage where the size of the risk estimated in risk analysis is compared against predefined criteria, and the risks are ranked to decide which to address first. Option a, “Prioritize the analyzed risks according to predefined criteria”, is exactly this definition and belongs to risk evaluation. Since b and c are not risk evaluation, only a qualifies, so the correct answer is ア.
Incorrectイ
Item a is correctly risk evaluation, but item b, “Identify the risks that exist in handling the information assets to be protected”, is the work of finding risks, which is the first of the three stages, risk identification. Because this option includes b, which is not evaluation, it is wrong.
Incorrectウ
Item b, identifying the risks, is risk identification, not risk evaluation. This option contains no evaluation item at all, so it is wrong.
Incorrectエ
Item c, “Establish the criteria for deciding whether to implement a response when a risk materializes”, is the work of setting up in advance the very judgment criteria used in evaluation, which is preparatory groundwork for the assessment. It is not the risk evaluation work of ranking risks against criteria, so it is wrong.
ここがポイント
- Risk assessment consists of three stages: risk identification (finding the risks) → risk analysis (estimating the size of the risks) → risk evaluation (comparing against criteria and ranking the priority of responses).
- Risk evaluation is the stage of judging the analysis results against predefined criteria and assigning priorities. The work of establishing the criteria themselves, and the work of identifying the risks, are not included in evaluation.
用語