IPA IP 2021 Question 30

Topic: Legal Affairs

A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問30, translated into English. ITPEC is based on the same exams.

Among the inappropriate acts A through C related to the handling of information, which of the following lists all and only those that correspond to the prohibited acts defined in the Act on the Prohibition of Unauthorized Computer Access?

AAnother person’s user ID and password written in a notebook that was found in the office were used without permission to log in to the company’s server via the network, and the personnel evaluation information stored there was viewed.BWhen a colleague left the desk, personnel evaluation information that was displayed on the colleague’s PC screen, and that one has no right to access, was viewed.CA USB memory containing personnel evaluation information that was kept in the department’s storage cabinet was taken out without the permission of the superior, and the personnel evaluation information was viewed on one’s own PC.

Explanation

Only A, logging in over the network with another person's ID and password — Japan's Act on the Prohibition of Unauthorized Computer Access is about using a computer over a network by getting round its access control.

The Act covers computers whose use over a network is controlled by an identification code such as a user ID and password. Unauthorized access is entering another person's code over the network, or evading the access control, to use such a computer without permission.

  • •A: another person's user ID and password, found in a notebook, used without permission to log in to the server over the network: unauthorized access, prohibited by the Act.
  • •B: reading what is already on a colleague's screen involves no login over a network, so it is not unauthorized access, though it breaks the company's rules.
  • •C: taking out a USB memory and reading it on one's own PC is removing a medium, not access over a network; it is a matter for internal rules, not this Act.

Answer (a)

Why not others:

  • •(b) — adds B, viewing a screen with no access over a network
  • •(c) — adds B and C, neither of which uses a network or an identification code
  • •(d) — adds C, carrying off a storage medium, which the Act does not cover

Key rule: The Act applies only where a computer is used over a network with another person's ID and password or by evading its access control; looking at a screen or taking a medium away is outside it.

Legal Affairs · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.