IPA FE Subject B 2024 Question 6

Topic: Security Scenarios

A question IPA Japan published in 令和６年度 基本情報技術者試験 科目B 公開問題 問6, translated into English. ITPEC is based on the same exams.

Company A is a trading company with 450 employees, and since last year it has been promoting telework from home as part of its work style reform. Figure 1 shows the system environment of Company A.

•Each employee is lent one desktop PC (hereinafter, in-house PC).•The systems that employees use include, in addition to the business system that Company A developed in-house and installed at Company A, the following two SaaS (hereinafter, the two SaaS are referred to as Company A’s cloud services).        1. Groupware with mail, chat and cloud storage functions            (hereinafter, Company A’s groupware)        2. Online meeting service•For telework, business use (BYOD) of employees’ personally owned PCs (hereinafter, private PCs) is permitted.•For telework, dedicated application software (hereinafter, dedicated app) is installed on each of the in-house PCs and the private PCs, and a remote desktop method is adopted in which the screen of the in-house PC’s desktop is transferred to the private PC.•The dedicated app has a function that prohibits downloading files from the remote desktop to the PC and copying and pasting files, character strings, images, etc. (hereinafter, save prohibition function), and Company A has enabled this function for private PCs.•Employees log in to the business system from the desktop of the in-house PC by entering their user ID and password.•Login to Company A’s cloud services is restricted, by settings on the side of Company A’s cloud services, so that it is possible only from Company A’s internal network. A user ID and password are used for login.

Figure 1 System environment of Company A (excerpt)

As telework became established, employees asked whether the situation could be improved, because connections from the in-house PCs to the internet had become extremely slow and were hindering their work. An investigation of the traffic between Company A’s internal network and the internet revealed that, compared with before telework was introduced, it had increased markedly during business hours. Therefore, the Information Systems Department decided to make a change to the network settings that enables a direct connection to Company A’s cloud services during telework, without going through either Company A’s internal network or the in-house PC.
When B, the information security leader of Company A, examined whether the setting change would cause any information security problems, B found that there were several problems. One of them is that the risk of unauthorized access to Company A’s cloud services increases. B therefore decided to ask the Information Systems Department to take a countermeasure to reduce the risk.

QuestionWhich of the following countermeasures did B decide to ask the Information Systems Department for? From the answer group, select the most appropriate one.

Answer group

Explanation

Two-factor authentication for connections from outside Company A — the direct connection removes the rule that logins work only from the internal network, so a stolen ID and password must no longer be enough.

Logins to the cloud services now work only from the internal network, with an ID and password. Direct connections during telework mean accepting logins from the internet, so anyone holding a leaked or guessed password could log in: the risk B found. A second factor required on connections from outside Company A stops a password alone from being enough.

Answer (c)

Why not others:

  • •(a) — watches only traffic from the internal network; the new risk comes from outside it, and watching does not block a login
  • •(b) — a speed limit targets the traffic problem, not unauthorized access
  • •(d) — the groupware, with mail and file storage, would still accept password-only logins from the internet
  • •(e) — disabling the save prohibition lets data be copied to private PCs, a new leak risk, and does nothing against unauthorized access

Key rule: When a network-location restriction is lifted, replace the protection it gave with stronger authentication on the newly exposed path, typically multi-factor authentication for access from outside.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.