問89
頻出度★★★
情報セキュリティに関する次の記述中の a, b に入れる字句の適切な組合せはどれか。 守るべき情報資産に対して望ましくない影響を及ぼす可能性のある原因のことを a といい, 情報資産自身の価値を損なう可能性をもつ弱点のことを b という。
令和8年度 ITパスポート試験 問89
テクノロジ系セキュリティ › 情報セキュリティ管理
This question's explanation and your answers so far.
解説
問 89
Incorrectア
An ‘incident’ is an event that has actually occurred when a threat exploits a vulnerability; it is not the ‘cause’ that brings about loss itself, so it does not fit a. Also, the ‘risk’ in b refers to the possibility that loss occurs, not a word that expresses the ‘weakness’ of the information asset itself. The definitions do not match.
- イ
正解 The correct answer is イ. The question defines a as ‘a cause that may have an undesirable effect on the information assets to be protected’ and b as ‘a weakness that may impair the value of the information asset itself.’ In information security, a cause that brings about loss, such as external attacks, disasters, or human error, is called a ‘threat,’ so a is ‘threat.’ Meanwhile, a managerial, technical, or design flaw (i.e., a weakness) that such a threat exploits is called a ‘vulnerability,’ so b is ‘vulnerability.’ Therefore the combination a: threat, b: vulnerability is correct, and イ is the answer. Note that the possibility of loss arising when a threat exploits a vulnerability is the ‘risk,’ and the relationship among the three can be organized as ‘risk = threat × vulnerability.’
Incorrectウ
‘Vulnerability’, which belongs in b, has been placed in a. ‘Vulnerability’ means a weakness, so it corresponds to the definition of b and is inappropriate for a (the cause). Furthermore, the ‘incident’ placed in b is an event that has occurred, not a ‘weakness’, so neither fits.
Incorrectエ
‘Risk’ is a concept expressing the possibility that loss occurs; it is not the ‘cause’ that has an effect itself, so it does not fit a. Also, the ‘threat’ in b is a cause (the word that belongs in a), not a word that refers to the ‘weakness’ of the information asset itself, so it is inappropriate for b as well.
ここがポイント
- Be able to distinguish the definitions and differences among the three terms: threat = the cause that brings about loss, vulnerability = the weakness that is exploited, and risk = the possibility that loss occurs when a threat exploits a vulnerability.
- Grasp the basic information-security relationship ‘risk = threat × vulnerability.’
用語