問91
頻出度★★★
情報セキュリティのリスクマネジメントにおけるリスク対応を, リスク移転, リスク回避, リスク低減及びリスク保有の四つに分けて実施することにしたとき, これらに関する記述として, 適切なものはどれか。
令和7年度 ITパスポート試験 問91
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 91
Incorrectア
The four risk treatments are options chosen according to the situation; they are not an implementation procedure that proceeds in a fixed order such as avoidance to transfer to reduction to retention. The premise is wrong.
Incorrectイ
As with ア, treating risk treatment as a fixed procedure of retention to reduction to transfer to avoidance is wrong. These are not an order but parallel options.
Incorrectウ
Taking out insurance in preparation for a risk materializing is risk transfer, in which the insurance company assumes the compensation for the loss; it is not risk avoidance (stopping the very activity that is the source of the risk).
- エ
正解 Risk transfer, avoidance, reduction, and retention are parallel options for responding to an identified risk. Managing the carrying of a laptop PC outside the company more strictly to prepare against its loss or theft is a measure that reduces the likelihood of occurrence and the size of the damage, so it falls under risk reduction. Therefore エ is appropriate.
ここがポイント
- The four risk treatment methods (transfer, avoidance, reduction, retention) are not an implementation order but parallel options chosen for each individual risk.
- Grasp the distinctions: risk reduction = measures that lessen the likelihood or impact; risk transfer = having a third party bear the loss via insurance, etc.; risk avoidance = stopping the activity that is the source of the risk itself.
用語