問68
頻出度★★★
資産A～Dの資産価値，脅威及び脆弱性の評価値が表のとおりであるとき，最優先でリスク対応するべきと評価される資産はどれか。ここで，リスク値は，表の各項目を重み付けせずに掛け合わせることによって算出した値とする。
| 資産名 | 資産価値 | 脅威 | 脆弱性 |
|---|---|---|---|
| 資産A | 5 | 2 | 3 |
| 資産B | 6 | 1 | 2 |
| 資産C | 2 | 2 | 5 |
| 資産D | 1 | 5 | 3 |
平成31年度 春期 ITパスポート試験 問68
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 68
- ア
正解 Since the risk value is obtained by multiplying each item together without weighting, it is calculated as risk value = asset value × threat × vulnerability. The risk value of each asset is: Asset A = 5×2×3 = 30, Asset B = 6×1×2 = 12, Asset C = 2×2×5 = 20, Asset D = 1×5×3 = 15. The largest is Asset A at 30, and the asset with the highest risk value should be given the highest priority for risk treatment, so the answer is Asset A (ア).
Incorrectイ
Asset B has the largest asset value of 6, but its threat is low at 1, so its risk value is only 6×1×2 = 12, among the smallest of the four assets. Since the evaluation is based on the product (risk value) rather than asset value alone, it is not the highest priority.
Incorrectウ
Asset C has the highest vulnerability at 5, but its asset value is low at 2, so its risk value is 2×2×5 = 20. This is second only to Asset A's 30, so it is not the highest priority.
Incorrectエ
Asset D has the highest threat at 5, but its asset value is the smallest at 1, so its risk value is 1×5×3 = 15. This is smaller than Asset A's 30, so it is not the highest priority.
ここがポイント
- The risk value is obtained as asset value × threat × vulnerability (the product without weighting), and the asset with the largest value is given the highest priority for risk treatment.
- The key point is to make a comprehensive evaluation based on the product of the three items, rather than judging by the magnitude of a single item alone (asset value only, threat only, or vulnerability only).
用語