IPA IP 2022 Question 56
A question IPA Japan published in 令和4年度 ITパスポート試験 公開問題 問56, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate example of a measure for reducing the damage, assuming a case where damage has been suffered from ransomware?
Explanation
Back up important files to a detachable external storage device — once ransomware has encrypted the files, a copy that it could not reach lets them be restored without paying.
Ransomware encrypts the files on a PC (and on drives connected to it) and demands money for the decryption key. The question assumes the infection has already happened, so it asks for a measure that limits the damage afterwards, not one that prevents the infection. Periodic backups restore the files to their last backed-up state. The device must be detached from the PC after each backup: a drive that stays connected is encrypted along with the PC's own files.
Answer (a)
Why not others:
- •(b) — different IDs and passwords per web service stop one leaked password from opening other accounts (password list attacks); they do nothing for files already encrypted
- •(c) — scanning with anti-malware software helps find and prevent infection, but it cannot decrypt files that ransomware has already encrypted
- •(d) — WPA2 encryption protects wireless traffic from eavesdropping; it does not protect or recover the files on the PC
Key rule: Against ransomware, the measure that reduces the damage is a regular backup kept offline (disconnected from the PC and network), so the files can be restored.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.