IPA IP 2020 Question 94

Topic: Security

A question IPA Japan published in 令和2年度 10月 ITパスポート試験 公開問題 問94, translated into English. ITPEC is based on the same exams.

Same question on ITPEC: Apr 2025 Q42

There is an IoT system that is composed of IoT devices and an IoT server that manages them. Which of the following is the appropriate combination of information security incidents (i) through (iii) in this system, and confidentiality, integrity, and availability that are compromised because of the incidents?

[Incident]

(i)An IoT device stopped working because its battery ran out.(ii)Communication between the IoT devices and the IoT server was not encrypted, so an information leakage occurred.(iii)Incorrect data was recorded because of a system fault.
Option(i)(ii)(iii)

Explanation

Availability, confidentiality, integrity — each incident damages a different one of the three properties of information security.

  • •(i) The device stops because its battery ran out: the device and its data cannot be used when needed, so availability is lost.
  • •(ii) Unencrypted traffic between the devices and the server is read by an outsider: information reaches someone not authorised to see it, so confidentiality is lost.
  • •(iii) A system fault records incorrect data: the information is no longer accurate, so integrity is lost.

Answer (b)

Why not others:

  • •(a) — gets (i) right but swaps (ii) and (iii): a leak discloses data without changing it, and wrong data is inaccurate, not disclosed
  • •(c) — calls the stopped device an integrity problem, but its data is not wrong, only unusable; (ii) and (iii) are then shifted too
  • •(d) — gets only (iii) right: a device that stops discloses nothing, and a leak does not stop anyone using the system

Key rule: Ask what happened to the information: seen by the wrong people is confidentiality, wrong or altered is integrity, not usable when needed is availability.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.