IPA IP 2021 Question 65
A question IPA Japan published in 令和3年度 ITパスポート試験 公開問題 問65, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate example of shadow IT?
Explanation
Using an online storage service the company has not permitted — shadow IT is IT that employees use for work without the organisation's approval.
Shadow IT covers personal devices, cloud services, free software and the like that staff bring into their work on their own judgement, out of sight of the IT department. Even with good intentions, such as getting a large file to a business partner, the company cannot manage the security of that service or the data placed in it, so it risks information leakage and breaches of rules.
Answer (d)
Why not others:
- •(a) — a backup made at a remote site under the company's rules is an approved disaster measure
- •(b) — peeking at someone typing a password is shoulder hacking, a form of social engineering, and logging in with it is unauthorized access, not shadow IT
- •(c) — locking the screen when leaving the seat is a countermeasure against peeking, not unapproved IT use
Key rule: Shadow IT is the unapproved use of IT for work; the danger is that the organisation cannot see or control it.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.