IPA FE Subject A 2025 Question 15
A question IPA Japan published in 令和７年度 基本情報技術者試験 科目A 公開問題 問15, translated into English. ITPEC is based on the same exams.
Among the situations identified by performing an information security audit of the status of physical security measures for a server room in light of the Information Security Management Standards (2016), which of the following should the auditor record in the audit report as a finding?
Explanation
The door into the server room from outside the company is not kept locked — an entrance that anyone outside can use unchecked defeats the physical entry control the audit examines.
The Information Security Management Standards (published by Japan's Ministry of Economy, Trade and Industry and based on ISO/IEC 27002) expect a secure area such as a server room to have physical entry controls, so that only authorized persons can enter and every entry can be traced. A door that leads into the server room directly from outside the company is the most exposed point of that perimeter. Leaving it unlocked for convenient entry and exit lets outsiders walk in without authentication or a record. It should be locked at all times and opened only by an authorized person, so the auditor records it as a finding.
Answer (c)
Why not others:
- •(a) — alarms that work in unmanned areas even during business hours detect an intrusion where nobody would see it, a control the standards recommend
- •(b) — emergency exits, evacuation equipment and guide lights protect people in a fire or disaster; they are expected safety measures, not a weakness
- •(d) — not showing where the server room is makes it harder for an intruder to find, a recommended measure
Key rule: In finding questions, three options describe controls that are in place; the finding is the one that leaves a risk to the asset uncontrolled, such as an unlocked entrance to a secure area.
System Audit · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.