IPA FE Subject B first sample Question 6

Question

Company A, a manufacturer, sells products to individuals by using an EC site (hereinafter, Company A’s EC site is referred to as site A). On site A, Company A’s products and services can be searched, and site A has a login function and manages information such as the names and email addresses (hereinafter, member information) of individuals who have registered in advance to use site A (hereinafter, members). Site A runs on Company B’s PaaS, and uses the DBMS and the application server on the PaaS.
Company A outsources the development and operation of site A to Company C. The outsourcing contract between Company A and Company C states that Company C implements the countermeasures against vulnerabilities in the Web application programs.

Recently, an incident occurred in which a vulnerability in a Web site operated by another company in the same industry as Company A was exploited and personal information was leaked. Therefore, Company A requested Company D, which provides security assessment services, to perform a vulnerability assessment of site A. As a result of the vulnerability assessment, multiple security vulnerabilities that require countermeasures were pointed out. Figure 1 shows the findings from Company D.

(i)  The DBMS used by site A has a known vulnerability, and there is a risk of an attack that exploits the vulnerability. (ii)  The OS of the application server used by site A has a known vulnerability, and there is a risk of an attack that exploits the vulnerability. (iii)  The login function has a vulnerability, and there is a risk that, of the information stored in the database of site A, information that is not disclosed to members is viewed.

Figure 1 Findings from Company D

Question From the answer group, select the appropriate combination of the organizations that deal with each of item numbers (i) through (iii) in Figure 1.

Accepted Answer

e) (i): Company B; (ii): Company B; (iii): Company C

Answer

a) (i): Company A; (ii): Company A; (iii): Company A

Answer

b) (i): Company A; (ii): Company A; (iii): Company C

Answer

c) (i): Company A; (ii): Company B; (iii): Company B

Answer

d) (i): Company B; (ii): Company B; (iii): Company B

Answer

f) (i): Company B; (ii): Company C; (iii): Company B

Answer

g) (i): Company B; (ii): Company C; (iii): Company C

Answer

h) (i): Company C; (ii): Company B; (iii): Company B

Answer

i) (i): Company C; (ii): Company B; (iii): Company C

Answer

j) (i): Company C; (ii): Company C; (iii): Company B

Explanation