IPA FE Subject B 2025 Question 6

Topic: Security Scenarios

A question IPA Japan published in 令和７年度 基本情報技術者試験 科目B 公開問題 問6, translated into English. ITPEC is based on the same exams.

Company A is an electronic equipment manufacturer with 200 employees. Its head office is in Tokyo, and it has a factory in Niigata.
Company A operates its file servers as shown in Figure 1.

•The file servers are installed in the server rooms of the head office and the factory.•The file servers acquire backups of files by using magnetic tapes.•A full backup is acquired starting at 2:00 a.m. on Saturday, and incremental backups are acquired starting at 2:00 a.m. on Tuesday and Thursday of the following week.•Every Monday, Tuesday, and Thursday at around 10:00 a.m., the person in charge in the Information Systems Department checks the execution results of the backup jobs and replaces the magnetic tapes, and keeps the magnetic tapes in a fireproof safe.•Backups are acquired on the magnetic tapes in overwrite mode, and one month’s worth of magnetic tapes is managed in generations.•So far, a restore from a full backup has taken 4 hours on average, and a restore from one incremental backup 0.25 hours on average.•Company A conducts tests for ICT continuity, and the file servers are also subject to the tests.
Note:Based on the results of a business impact analysis, a recovery point objective (RPO) of 72 hours and a recovery time objective (RTO) of 120 hours are defined as requirements for the file servers.

Figure 1 Operation of the file servers at Company A

Company A has acquired ISMS certification, works on information security with the Chief Information Security Officer (CISO) at the center, and regularly conducts information security risk assessments. Now that the ISMS certification criteria have been revised to JIS Q 27001:2023, B, the information security leader, is to prepare for the transition audit to the new criteria. For the information security controls newly added by the revision, B checked the status of the efforts with the person in charge in the Information Systems Department, and summarized the evaluation results in Table 1.

Table 1 Evaluation results by B (excerpt)

Item No.Information security controlEvaluation result
1(ICT readiness for business continuity) Based on business continuity objectives and ICT continuity requirements, ICT readiness shall be planned, implemented, maintained and tested.Implemented

In the internal audit before the transition audit, B received several questions from the Internal Audit Office about the operation of the file servers related to item No. 1 in Table 1, and answered as shown in Table 2.

Table 2 B’s answers to the Internal Audit Office (excerpt)

Item No.B’s answer
1For example, if a failure occurs at noon on Friday, at least the data as of A1 must be restored.
2For example, if a failure occurs at noon on Thursday and all the data on the file servers is lost, the restore from the backups is expected to take A2 hours.
3The ICT continuity plan is approved by A3.
QuestionFrom the answer group for A below, select the appropriate combination of words to be inserted into A1 through A3 in Table 2.

Answer group for A

OptionA1A2A3

Explanation

A1: noon on Tuesday, A2: 4.50, A3: CISO — the RPO says how old the restored data may be, a restore from incremental backups needs the full backup and every incremental after it, and the plan is approved by the person who leads information security.

  • •A1: with an RPO of 72 hours, a failure at noon on Friday may lose at most the last 72 hours, so the data as of noon on Tuesday at the latest must come back. Noon on Monday is 96 hours earlier, more loss than the RPO allows.
  • •A2: at noon on Thursday the backups are the full backup from 2:00 a.m. on Saturday and the incremental backups from 2:00 a.m. on Tuesday and on Thursday (that tape was changed at about 10:00 a.m. and is in the safe). Each incremental backup holds only the changes since the backup before it, so all three are restored in turn: 4 + 0.25 + 0.25 = 4.50 hours, well inside the 120-hour RTO.
  • •A3: Company A runs its ISMS with the CISO at the center, and a plan in the ISMS is approved by the responsible manager, the CISO. The person who runs the backups carries the plan out, and the Internal Audit Office checks it, so neither approves it.

Answer (h)

Why not others:

  • •(a), (b), (c), (d) and (e) — A1 noon on Monday is 96 hours before the failure, beyond the 72-hour RPO
  • •(a), (b), (c), (f) and (g) — A2 4.25 restores only one incremental backup; with incremental backups both the Tuesday and the Thursday sets are needed after the full backup
  • •(b), (e), (f) and (i) — A3 the person in charge in the Information Systems Department operates the backups and the tests; the one who carries out a plan does not approve it
  • •(c), (g) and (j) — A3 the head of the Internal Audit Office must stay independent of what the office audits, so cannot approve the plan

Key rule: Count the RPO back from the moment of failure to find the oldest data allowed, and restore incremental backups as the last full backup plus every incremental taken since.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.