問99
頻出度★★★
情報セキュリティのリスクマネジメントにおいて, リスク移転, リスク回避, リスク低減, リスク保有などが分類に用いられることがある。これらに関する記述として, 適切なものはどれか。
令和3年度 ITパスポート試験 問99
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 99
- ア
正解 Risk transfer, risk avoidance, risk reduction, and risk retention are a classification of the countermeasures applied to identified risks during the “risk treatment” stage of risk management. Option ア correctly states this positioning and then treats taking out insurance to prepare for the materialization of a risk (occurrence of loss) as risk transfer. Buying insurance is a typical example of moving the burden of loss caused by a risk to a third party, namely the insurance company, so classifying it as risk transfer is appropriate. Therefore ア is correct.
Incorrectイ
The framework is wrong. The four terms are a classification of countermeasures in “risk treatment,” not in “risk identification,” and they are not a classification of the purpose of use of owned assets. Introducing anti-malware software is a measure that lowers risk, so classifying it as risk reduction is itself correct, but because the underlying positioning is wrong, this option is inappropriate.
Incorrectウ
The framework is wrong. The four terms are not a classification of evaluation methods in “risk evaluation,” but a classification of countermeasures in “risk treatment.” Risk avoidance refers to a countermeasure that stops or eliminates the risk factor itself, and the explanation “a method that evaluates whether it can be avoided” also misses the essence.
Incorrectエ
The framework is wrong. The four terms are not a classification of analysis techniques in “risk analysis,” but a classification of countermeasures in “risk treatment.” Moreover, the technique of expressing a vulnerability with objective numerical values is a quantitative risk analysis method and has nothing to do with risk retention, which accepts and holds a risk. It is wrong on two counts.
ここがポイント
- The four categories of risk treatment: risk transfer (move it to a third party, insurance) / risk avoidance (eliminate the factor, stop the activity) / risk reduction (lower the probability and impact through countermeasures) / risk retention (accept and hold it as is).
- Keep in mind that these belong to the “risk treatment” stage that comes after analysis and evaluation, and are not classifications of the risk identification or risk analysis stages.
用語