IPA FE Subject B sample Question 19

Topic: Security Scenarios

A question IPA Japan published in 基本情報技術者試験 科目B サンプル問題 問19, translated into English. ITPEC is based on the same exams.

Company A is a mail-order company with 200 employees. It sells household goods, gift items, etc. to general consumers. Product Z, one of the products it handles, is handled by the Z Sales Section.

[Work of the Z Sales Section]

Currently, the staff of the Z Sales Section perform order management work and inquiry handling work for product Z. Figure 1 shows the procedure of the order management work for product Z.

Orders for product Z from customers arrive by email.(1) Input    The salesperson enters the details of a received order (including changes and cancellations) into the order management system1) (hereinafter, J system), and requests the sales manager2) to approve it.(2) Approval    The sales manager checks the details of the order against the result of the input into J system, and approves it if there is no problem. If there is a problem, the sales manager sends it back.
Note 1)Operated by the Information Systems Department of Company A. The users are the sales manager, the salespersons, etc.Note 2)Only one person, the section manager of the Z Sales Section.

Figure 1 Procedure of the order management work

[Operation privileges of J system]

The Z Sales Section has established the following usage policies for J system.

[Policy 1]Information entered by a user is approved by another user.[Policy 2]The sales manager can view the information of all the work of the Z Sales Section.

J system implements a function that grants users the operation privileges necessary for their work.
Recently, since the order management work for product Z has been growing with an increase in orders, it was decided to outsource part of it to Company B (hereinafter, an employee of Company B who performs the input work of the order management work for product Z is referred to as a Company B salesperson for product Z, and an employee of Company B who views the input results of the Company B salespersons for product Z and, if there are deficiencies, verbally asks Company A to send them back is referred to as a Company B sales manager for product Z).

For the outsourcing, the Z Sales Section communicated the following requirements on J system to the Information Systems Department.

[Requirement 1]When Company B makes an input, Company A approves it.[Requirement 2]When a salesperson of Company A makes an input, the sales manager of Company A approves it, as at present.

Based on the above, the Information Systems Department summarized in Table 1 the operation privileges to be granted to each user from now on, and had them checked by C, the information security leader of the Z Sales Section.

Table 1 Draft of operation privileges

Operation privileges grantedUserJ systemViewingInputApproval(Omitted)Salesperson of the Z Sales Section(Omitted)(Omitted)(Omitted)A1A2
Note:○ indicates that the operation privilege is granted.
QuestionFrom the answer group for A below, select the appropriate combination of words to be inserted into A1 and A2 in Table 1.

Answer group for A

OptionA1A2

Explanation

A1: Company B sales manager for product Z, A2: Company B salesperson for product Z — each user gets only the privileges its work needs, and Requirement 1 keeps approval at Company A.

The row with Viewing and Approval, its name omitted, is Company A’s sales manager: Policy 2 lets the manager view all the work, and the manager approves. Company B’s two roles are then the rows left:

  • •A2 has Viewing and Input: the Company B salesperson for product Z enters orders and must see what was entered. No Approval, since under Requirement 1 Company A approves what Company B enters.
  • •A1 has Viewing only: the Company B sales manager for product Z only views the salespersons’ input and asks Company A by word of mouth to send faulty entries back, so it needs no Input and, again under Requirement 1, no Approval.

Answer (d)

Why not others:

  • •(a) and (b) — A1 the sales manager of the Z Sales Section must approve (Requirement 2), so needs Approval, not Viewing only
  • •(c) — A2 the sales manager of the Z Sales Section approves rather than enters; giving the manager Input and no Approval breaks Requirement 2
  • •(e) — swaps the two Company B roles: the salesperson, who enters orders, would have no Input, and the sales manager, who only checks, would get Input

Key rule: Give each role the least privilege its tasks need, and keep entry and approval with different users, so that no one can approve their own input.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.