問93
頻出度★★★
情報セキュリティにおける脅威の説明として, 適切なものはどれか。
令和7年度 ITパスポート試験 問93
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 93
Incorrectア
“A weakness in an information system that an attacker can exploit” is not a threat but a description of a “vulnerability.” It refers to inherent weaknesses—such as security holes or misconfigurations—that allow attacks to succeed. This is a different concept from a threat (a cause of damage), so it is wrong.
Incorrectイ
“The combination of the probability that an information asset suffers damage and the scale of that damage” is not a threat but a description of “risk.” Risk is a concept evaluated by multiplying the probability of damage by its impact (scale of damage), which differs from a threat that is the cause itself, so it is wrong.
- ウ
正解 A threat is something that can become a cause of damage to information assets. Specifically, unauthorized access, malware, theft, disasters such as earthquakes or fires, and operational mistakes—anything that is itself a cause of harm to the confidentiality, integrity, or availability of information assets—is a threat. Choice ウ, “Something that can become a cause of damage to information assets,” exactly matches this definition of a threat, so it is correct. It helps to remember the relationship among the three: a threat is realized by exploiting a “vulnerability (weakness),” which in turn produces a “risk (the possibility of damage).”
Incorrectエ
“The possibility of suffering damage from an attack that exploits a weakness in an information system” is also not a threat but is closer to a description of “risk (the possibility of damage).” It describes the “possibility of damage” that arises when a threat (the cause) exploits a vulnerability (weakness), not the definition of a threat itself, so it is wrong.
ここがポイント
- Threat = something that can become a cause of damage to information assets; vulnerability = a weakness that an attacker can exploit; risk = the possibility of suffering damage when a threat exploits a vulnerability (probability × impact). Clearly distinguish among these three terms.
- Keeping in mind the relationship “risk = threat × vulnerability” lets you organize the cause (threat), the weakness (vulnerability), and the possibility of the outcome (risk), making it harder to confuse the choices.
用語