IPA FE Subject B sample Question 17

Topic: Security Scenarios

A question IPA Japan published in 基本情報技術者試験 科目B サンプル問題 問17, translated into English. ITPEC is based on the same exams.

Company A, a manufacturer, sells products to individuals by using an EC site (hereinafter, Company A’s EC site is referred to as site A). On site A, Company A’s products and services can be searched, and site A has a login function and manages information such as the names and email addresses (hereinafter, member information) of individuals who have registered in advance to use site A (hereinafter, members). Site A runs on Company B’s PaaS, and uses the DBMS and the application server on the PaaS.
Company A outsources the development and operation of site A to Company C. The outsourcing contract between Company A and Company C states that Company C implements the countermeasures against vulnerabilities in the Web application programs.

Recently, an incident occurred in which a vulnerability in a Web site operated by another company in the same industry as Company A was exploited and personal information was leaked. Therefore, Company A requested Company D, which provides security assessment services, to perform a vulnerability assessment of site A. As a result of the vulnerability assessment, multiple security vulnerabilities that require countermeasures were pointed out. Figure 1 shows the findings from Company D.

Item No. 1 The OS of the application server used by site A has a known vulnerability, and there is a risk of an attack that exploits the vulnerability.Item No. 2 Site A has a cross-site scripting vulnerability, and there is a risk that member information is obtained illicitly.Item No. 3 The DBMS used by site A has a known vulnerability, and there is a risk of an attack that exploits the vulnerability.

Figure 1 Findings from Company D

QuestionFrom the answer group, select the appropriate combination of the organizations that deal with each of the item numbers in Figure 1.

Answer group

OptionItem No. 1Item No. 2Item No. 3

Explanation

Company B, Company C, Company B — the OS and the DBMS are part of Company B’s PaaS, while cross-site scripting is a flaw in the Web application that Company C is contracted to secure.

  • •Item No. 1: on a PaaS the provider runs the platform (OS, middleware) and the customer only deploys its application, so the application server’s OS is patched by Company B.
  • •Item No. 2: cross-site scripting comes from the Web application program itself, and the contract makes Company C responsible for vulnerability countermeasures in it.
  • •Item No. 3: the DBMS is also provided on the PaaS, so Company B fixes it.

Company A owns site A but neither manages the platform nor writes the code, so it fixes none of the three itself.

Answer (f)

Why not others:

  • •(a), (b) and (c) — Item No. 1 to Company A, which as a PaaS customer has no control over the OS
  • •(h), (i) and (j) — Item No. 1 to Company C, whose contract covers the application, not the platform
  • •(a), (b), (c), (d), (e), (h) and (i) — Item No. 2 to Company A or B, but the contract puts application flaws on Company C
  • •(b), (e), (g) and (i) — Item No. 3 to Company C, but the DBMS is a PaaS component that Company B maintains

Key rule: On PaaS the provider answers for the platform (OS, middleware, DBMS) and the customer, or its contractor, for the application; a vulnerability is fixed by whoever manages its layer.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.