平成31年度春期 ITパスポート試験問38

This question's explanation and your answers so far.

問38

頻出度★★★

SNS の事例における IT サービスマネジメントの要件に関する記述のうち, 機密性に該当するものはどれか。

出典　平成31年度春期 ITパスポート試験問38

解説

問 38

Incorrectア
“It is available 24 hours a day, 365 days a year” describes the property of being able to use the service whenever needed, that is, “availability (Availability)”, not confidentiality.
イ
正解 Among the three elements of information security, “confidentiality (Confidentiality)” refers to the property whereby only authorized, legitimate users can access information or services, while those without permission are neither shown the data nor allowed to use it. Choice イ, “Unauthorized users cannot access the data or services”, states exactly this definition of confidentiality, so it is correct. In an SNS, using access control so that posts set to private are not seen by unrelated third parties is what ensures confidentiality.
Incorrectウ
“Even if a disaster such as an earthquake occurs at the server location, use can be resumed within 1 hour” is the property of recovering in a short time after a fault or disaster and continuing to use the service, which also falls under “availability (Availability)”. It is unrelated to confidentiality.
Incorrectエ
“Users can edit posted photos and follow other users” describes the functionality that the SNS itself provides, and is not any of the requirements among the three elements of information security (confidentiality, integrity, availability).

ここがポイント

Confidentiality = the property whereby only authorized people can access information and access by those without permission is prevented. Access control and authentication are its typical means.
The three elements of information security (CIA): confidentiality, integrity, availability. Being always usable (24 hours a day, 365 days a year; quick recovery after a disaster) is “availability”, and should not be confused with confidentiality.

用語

解答問38イ