問72
頻出度★★★
ISMS の導入効果に関する次の記述中の a, b に入れる字句の適切な組合せはどれか。 [ a ] マネジメントプロセスを適用することによって, 情報の機密性, [ b ] 及び可用性をバランス良く維持, 改善し, [ a ] を適切に管理しているという信頼を利害関係者に与える。
平成31年度 春期 ITパスポート試験 問72
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 72
Incorrectア
b = integrity is correct, but a = quality is wrong. The system that manages quality is a Quality Management System (QMS, the ISO 9001 family); what an ISMS applies is a risk management process.
Incorrectイ
a = quality is wrong (it should be risk). In addition, b = validity is not among the three elements of information security (confidentiality, integrity, availability), so it is wrong on both counts.
- ウ
正解 An ISMS (Information Security Management System) is a framework that views information from the perspective of ‘risk’ and applies a risk management process to maintain and improve information security. Blank a takes ‘risk’, which fits this context, and the closing phrase ‘giving stakeholders the confidence that [a] is being managed appropriately’ also reads naturally as ‘risk is being managed appropriately’. Blank b appears in the sequence ‘confidentiality, [b], and availability’, so it takes ‘integrity’, the remaining one of the three elements of information security (confidentiality, integrity, availability). Therefore the combination a = risk, b = integrity, namely ‘ウ’, is the correct answer.
Incorrectエ
a = risk is correct, but b = validity is wrong. What belongs alongside confidentiality and availability is the remaining element ‘integrity’; ‘validity’ is not one of the three elements of information security.
ここがポイント
- The three elements of information security (CIA) are confidentiality, integrity, and availability. If confidentiality and availability are already stated, the remaining blank is integrity.
- An ISMS is a framework that applies a risk management process to maintain and improve information security in an organized way, thereby earning stakeholders’ trust (a = risk).
用語