IPA FE Subject B sample Question 18

Topic: Security Scenarios

A question IPA Japan published in 基本情報技術者試験 科目B サンプル問題 問18, translated into English. ITPEC is based on the same exams.

Company A is a company with 1,000 employees that conducts IT development. There are 50 employees in the General Affairs Department and 50 in the Sales Department, and the others belong to the Development Department. 90% of the members of the Development Department are stationed at customer sites. Currently, the usage of PCs at Company A is as shown in Figure 1.

1 Company A’s PCs•Members of the General Affairs Department, members of the Sales Department, and members of the Development Department who work at Company A’s office are each lent one PC prepared by the company (hereinafter, Company A PC).•Members of the Development Department stationed at customer sites are not lent a Company A PC, but instead, shared PCs are provided for them to use when they come to Company A’s office.2 Use of the business system by members of the Development Department stationed at customer sites•For members of the Development Department stationed at customer sites to use the business system for applying for leave, settling expenses, etc., they need to use a shared PC.3 Use of VPN at Company A•A VPN server is installed at Company A, so that members of the Sales Department on business trips can make a VPN connection from a Company A PC to the internal network via the internet and use the business system. The rules stipulate that a Company A PC is to be used for VPN connections.

Figure 1 Usage of PCs at Company A

Company A considered it inefficient for members of the Development Department stationed at customer sites to come to Company A’s office only to use the business system, and decided to consider permitting members of the Development Department stationed at customer sites to use their personally owned PCs for business (BYOD) and to make VPN connections.

QuestionWhich of the following is the combination that lists two risks considered to increase or newly arise when members of the Development Department stationed at customer sites are permitted to make VPN connections from personally owned PCs? From the answer group, select the most appropriate one.
(i)Risk that VPN connections increase and availability is impaired(ii)Risk that a member of the Development Department stationed at a customer site loses a Company A PC(iii)Risk that a member of the Development Department stationed at a customer site clicks the URL in a phishing email and the personally owned PC is infected with malware(iv)Risk that a member of the General Affairs Department makes a VPN connection with a personally owned PC(v)Risk that a personally owned PC infected with malware is connected to the internal network by VPN and the malware spreads over the internal network

Answer group

Explanation

More load on the VPN, and malware spreading through it — the change lets hundreds of people connect, and from PCs that Company A does not manage.

Of the 1,000 employees, 900 are in the Development Department and 90% of them, 810, are stationed at customer sites. Today only Sales Department members on business trips use the VPN; letting the 810 connect as well can overload the VPN server and line, so availability suffers: item (i).

A personally owned PC is outside Company A’s control: its patches, antivirus and private use are up to its owner. Once it may join the VPN, malware on it reaches the internal network directly and can spread there: item (v).

Answer (d)

Why not others:

  • •(a), (e), (f) and (g) — include (ii): staff at customer sites are not lent a Company A PC, so there is none for them to lose
  • •(b), (e), (h) and (i) — include (iii): a personal PC can catch malware from phishing whether or not it may use the VPN; the new risk is what the infection reaches, (v)
  • •(c), (f), (h) and (j) — include (iv): the permission is for staff at customer sites only, and General Affairs staff work at the office with Company A PCs

Key rule: A risk that a change creates is one the change itself causes: count the new load it brings and the unmanaged devices it lets into the internal network, not risks that exist anyway.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.