IPA FE Subject B 2026 Question 6

Topic: Security Scenarios

A question IPA Japan published in 令和８年度 基本情報技術者試験 科目B 公開問題 問6, translated into English. ITPEC is based on the same exams.

Company A is an advertising agency with 1,000 employees. At Company A, the file server that each department has installed on Company A’s internal network is managed by the operations staff of the department that installed it. When a department uses a new cloud service, the department signs the contract with the approval of the person responsible for the department, and the department’s operations staff manage the service.
The Sales Department uses a file server that the Sales Department installed on Company A’s internal network (hereinafter, server Y) and a cloud service for customer management (hereinafter, service Z). Each employee of the Sales Department is assigned a general user account of server Y, and can edit all files on server Y. In addition, each employee of the Sales Department is assigned a general user account of service Z, and the operations staff of the Sales Department are assigned administrator accounts of server Y and service Z.
In preparation for the occurrence of information security incidents related to cloud services, the information security department established rules on the management of logs of the cloud services used by each department, as shown in Figure 1.

1. Acquisition of logsAcquire the following logs•Logs of login and logout (hereinafter, login logs)•Logs of important operations in the cloud service and their success or failure2. Items of logsAt least the following must be recorded•The name of the target account, the date and time in Japan Standard Time, and the operation performed3. Access management of logs•Ensure that only the operations staff can access the logs•When logs are exported from the cloud service and stored, store the logs on the department’s own file server installed on the internal network, and ensure that only the operations staff can access them•Assign more than one person as the operations staff•Require two-factor authentication for logins of the operations staff to the cloud service4. Retention period of logs•Ensure that logs for at least the past one year can be referred to5. Countermeasures against falsification•Ensure that logs cannot be written or erased, even by the operations staff

Figure 1 Rules on the management of logs of the cloud services used by each department

Section Manager B, the information security leader of the Sales Department, investigated whether the rules in Figure 1 were complied with, with the cooperation of Chief C of the operations staff and the information security department.
Section Manager B summarized the current operations of service Z that violate the rules in Figure 1, as shown in Table 1.

Table 1 Current operations that violate the rules in Figure 1

Item No.Current operation
(i)The logs of service Z are overwritten, starting from the oldest logs, when the free space falls to a certain value or below.
(ii)Service Z was operated by two persons of the Sales Department, Chief C and Chief D, but since Chief D left the company last month, it is currently operated by Chief C only.
(iii)The dates and times in the logs of service Z are recorded in UTC.
(iv)All logs of service Z are exported at the end of every month and stored on server Y.
QuestionFrom the answer group below, select the combination that lists all of, and only, the item numbers of the operations in Table 1 that violate rule 3 in Figure 1.

Answer group

Explanation

Items (ii) and (iv) — rule 3 is about who can reach the logs: only the operations staff, exports kept where only they can read them, more than one of them, and two-factor login.

Check each item against the rule it breaks:

  • •(ii) — since Chief D left, Chief C alone operates service Z; rule 3 requires more than one person as the operations staff
  • •(iv) — the exported logs sit on server Y, the department's own server on the internal network, but every Sales employee has an account there that can edit all files, so not only the operations staff can access them; rule 3 is broken
  • •(i) — overwriting the oldest logs when space runs low means a full year of logs may not be kept; that breaks rule 4 (retention), not rule 3
  • •(iii) — recording times in UTC breaks rule 2, which requires the date and time in Japan Standard Time

So exactly (ii) and (iv) violate rule 3.

Answer (i)

Why not others:

  • •(a), (b), (c), (d), (e) and (f) — include (i), a breach of the retention rule (rule 4); (b), (d) and (e) also include (iii), and (a), (b) and (d) leave out (iv)
  • •(g), (h) and (j) — include (iii), a breach of the log-item rule (rule 2); (g) also leaves out (iv) and (j) leaves out (ii)

Key rule: Match each finding to the control it defeats: what a log records, how long it is kept and who can reach it are separate rules, and an exported copy is only as safe as the place it lands.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.