IPA FE Subject A 2023 Question 14
A question IPA Japan published in 令和５年度 基本情報技術者試験 科目A 公開問題 問14, translated into English. ITPEC is based on the same exams.
Company A is planning to implement teleworking, in which employees connect to the company’s network via the Internet from PCs at their homes to do their work. An audit of the teleworking operation rules established by Company A was performed in accordance with the Information Security Management Standards (2016). Among the matters identified, which of the following should the auditor record in the audit report as a finding?
Explanation
Each employee decides whether anti-malware software is installed — a basic security control left to each user's judgment is a gap the auditor must report.
The Information Security Management Standards (published by Japan's Ministry of Economy, Trade and Industry and based on ISO/IEC 27002) expect an organization that allows teleworking to set a policy and security measures for it, protection against malware among them. A PC that connects from home over the Internet to the company network is exposed to infection and can carry malware into the company. Whether it is protected must be fixed by the rules, not left to each employee, so this rule is recorded as a finding.
Answer (c)
Why not others:
- •(a) — use is allowed only on condition that the rules are followed, so the rules still govern every teleworker; that is a controlled permission
- •(b) — limiting teleworking to PCs supplied by Company A lets the company manage their configuration and security, a recommended measure
- •(d) — keeping family members off the PC prevents unauthorized use and accidental leaks, also a recommended measure
Key rule: In a finding question, three options describe controls in place; the finding is the one where a required control is missing or left to individual discretion.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.