IPA FE Subject B sample Question 20

Topic: Security Scenarios

A question IPA Japan published in 基本情報技術者試験 科目B サンプル問題 問20, translated into English. ITPEC is based on the same exams.

Company A is a company with 500 employees that deals in dietary supplements. The operation of Company A’s information systems, including its servers and firewall (hereinafter, FW), is handled by the Information Systems Department.
One day, there was an audit by the Internal Audit Department, and when Department Manager B of the Information Systems Department explained the operational status of the FW as shown in Figure 1, the findings shown in Table 1 were received.

•The operation of the information systems, including the FW, is handled by six operators belonging to the operations team of the Information Systems Department.•There are three tasks in the operation of the FW: editing of FW rules, checking of operation logs, and checking of the edited FW rules and approval of the operation (hereinafter, checking of the edited FW rules and approval of the operation is referred to as operation approval).•FW rules are edited in accordance with operation instructions prepared in advance.•The FW has three functions: editing of FW rules, checking of operation logs, and operation approval.•Changing an FW rule requires both editing of the FW rule and operation approval. Operation logs are checked before operation approval.•FW user IDs are issued individually to each operator, and user IDs are not shared.•In the FW, privileges to use the functions can be granted for each operator’s user ID.•Currently, all six operators are granted all privileges, and after an operator edits the rules of the FW, the operator who did the editing confirms that there are no errors in the operation and performs operation approval.•Passwords are used for logging in to the FW. The passwords are 8 alphanumeric characters.•In the operation of the FW, it can be set for each operator’s user ID whether the operator can log in at the console without going through the network, and whether the operator can log in remotely via the network.•The FW provides the same functions whether one logs in at the console without going through the network or logs in remotely via the network.•The FW is installed in the server room, and several other kinds of servers are also installed in the server room.•Only the operators are permitted to enter and leave the server room.

Figure 1 Operational status of the FW

Table 1 Findings from the Internal Audit Department

FindingDetails of finding
Finding 1In the work of operating the FW, duties are not appropriately segregated.
Finding 2(Omitted)
Finding 3(Omitted)
Finding 4(Omitted)

Department Manager B decided to consider improvement measures for the findings in Table 1.

QuestionRegarding finding 1 in Table 1, which of the following is an improvement measure to prevent erroneous changes to FW rules? From the answer group, select the most appropriate one.

Answer group

Explanation

Separate those who edit FW rules from those who check the logs and approve, each with the least privileges — finding 1 is a missing segregation of duties: today the person who edits a rule also approves it.

Every operator holds all privileges, and after editing a rule the same operator checks the work and gives the operation approval. A mistake is checked only by the person who made it. The FW can grant privileges per user ID, so the duties can be split: editors get only the editing privilege, and others get the log-checking and approval privileges. A change then needs two people, the second checking the log before approving.

Answer (f)

Why not others:

  • •(a) — EDR watches the console for malicious activity; it does not stop an authorised operator’s mistaken edit
  • •(b) — multi-factor authentication proves who logs in, but the person who edits still approves their own change
  • •(c) — the FW offers the same functions from the console and remotely, so splitting by login route separates nothing
  • •(d) — one operator does every step alone, the opposite of segregation
  • •(e) — the log checkers cannot approve, so the editors still approve their own changes and keep all privileges
  • •(g) — a weekly rota changes who works each day, not the fact that one person edits and approves

Key rule: Segregation of duties means the person who makes a change is not the one who approves it, enforced by giving each role only the privileges it needs.

Security Scenarios · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.