IPA IP 2020 Question 13

Topic: Legal Affairs

A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問13, translated into English. ITPEC is based on the same exams.

Among the inappropriate acts A through C related to the handling of information, which of the following lists all and only those that correspond to the prohibited acts defined in the Act on the Prohibition of Unauthorized Computer Access?

AAnother person’s ID and password written in a notebook that was found in the office were used without permission to log in to the company’s server via the network, and the personnel evaluation information stored on the server was viewed.BIn order to sneak a look at personnel evaluation information that one has no right to view, another person’s network ID and password were obtained without permission and recorded in one’s own notebook.CA USB memory containing personnel evaluation information that was kept in the department’s storage cabinet was taken out without the permission of the superior, connected directly to one’s own PC, and the personnel evaluation information was copied.

Explanation

A and B, logging in with another person’s ID and password, and obtaining them for that purpose — Japan’s Act on the Prohibition of Unauthorized Computer Access bans the login itself and the preparations for it.

Besides unauthorized access itself (using another person’s ID and password over a network without permission), the Act prohibits obtaining another person’s code for that purpose, giving it to others without good reason, storing a wrongfully obtained code, and phishing for codes.

  • •A: logging in to the server via the network with another person’s ID and password: unauthorized access, prohibited.
  • •B: obtaining another person’s ID and password without permission to view information one has no right to: obtaining a code for unauthorized access, prohibited even before any login.
  • •C: a USB memory carried off and read on one’s own PC involves no network and no access control, so it is outside this Act; it breaks internal rules instead.

Answer (b)

Why not others:

  • •(a) — leaves out B; the Act prohibits obtaining another person’s ID and password for unauthorized access, not only the login
  • •(c) — adds C, removing a storage medium, which uses no network
  • •(d) — adds C and leaves out A, the clearest case of unauthorized access

Key rule: The Act covers using another person’s ID and password over a network and also obtaining, handing out, storing or phishing for them; taking media away physically is outside it.

Legal Affairs · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.