This question's explanation and your answers so far.
情報の取扱いに関する不適切な行為 a～c のうち, 不正アクセス禁止法で定められている禁止行為に該当するものだけを全て挙げたものはどれか。 a オフィス内で拾った手帳に記載されていた他人の利用者 ID とパスワードを無断で使って, 自社のサーバにネットワークを介してログインし, 格納されていた人事評価情報を閲覧した。 b 同僚が席を離れたときに, 同僚の PC の画面に表示されていた, 自分にはアクセスする権限のない人事評価情報を閲覧した。 c 部門の保管庫に保管されていた人事評価情報が入った USB メモリを上司に無断で持ち出し, 自分の PC で人事評価情報を閲覧した。
正解 The “unauthorized access act” prohibited by the Unauthorized Access Prohibition Act refers to an act that, through a telecommunications line (network), uses another person’s user ID and password without permission, or exploits a security hole, so as to bring a computer that one has no access right to into a usable state. In case a, the person uses another person’s ID and password from a picked-up notebook without permission, logs in over the network to the company’s server, and views personnel evaluation information, which exactly matches “an unauthorized access act carried out over the network by misusing another person’s identification code.” Both b and c do not involve logging in over a network, so they fall outside this Act; only a applies. Therefore the correct answer is “ア (a).”
This includes b in addition to a, but in b the person merely “looked directly at” the information displayed on the screen of a colleague’s PC while the colleague was away, neither logging in over a network nor misusing another person’s identification code. The Unauthorized Access Prohibition Act requires access over a telecommunications line, so b does not apply and this combination is wrong.
This includes all of a, b, and c, but only a applies. Both b (peeking at a screen) and c (taking out a USB memory stick without permission and viewing it on one’s own PC) do not involve logging in over a network, so they are not prohibited acts under the Unauthorized Access Prohibition Act; hence this is wrong.
This includes c in addition to a, but c is a physical removal act, taking a USB memory stick out of the storage cabinet without permission and viewing it on one’s own PC, and is not access over the network using another person’s identification code. It falls outside the Unauthorized Access Prohibition Act (it is a separate matter such as theft or information leakage), so this combination is wrong.