IPA IP 2020 Question 68
A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問68, translated into English. ITPEC is based on the same exams.
When risk treatment is classified into transfer, avoidance, reduction, and retention, which of the following is the category of the treatment below?
[Treatment]
As a countermeasure against information leakage from documents on desks in the workplace, a clear desk at the time of leaving the office was introduced.
Explanation
Reduction — clearing desks when staff leave lowers the chance that documents left out are seen or taken.
The four ways to treat a risk:
- •Transfer: pass the loss to another party, as with insurance or outsourcing under a contract.
- •Avoidance: remove the cause, for example stop the activity or stop holding the information.
- •Reduction: take measures that lower the likelihood of the risk or the size of its damage.
- •Retention: accept the risk as it is, usually because it is small, and bear the loss if it occurs.
A clear desk rule keeps the same documents and the same work, but puts papers away at the end of the day so that nobody can read or take them from an empty desk. The risk remains, only less likely: that is reduction.
Answer (c)
Why not others:
- •(a) Transfer — nothing is passed to a third party such as an insurer
- •(b) Avoidance — the documents are still used; avoidance would mean, for example, no longer handling paper documents at all
- •(d) Retention — a measure is taken, so the risk is not simply accepted
Key rule: A control that makes an incident less likely or less damaging is risk reduction; insurance is transfer, quitting the activity is avoidance, doing nothing is retention.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.