IPA IP 2023 Question 15

Topic: Legal Affairs

A question IPA Japan published in 令和5年度 ITパスポート試験 公開問題 問15, translated into English. ITPEC is based on the same exams.

Among the inappropriate acts A through D related to passwords, which of the following lists all and only the acts that are regulated by the Act on the Prohibition of Unauthorized Computer Access?

AIn order to have a colleague perform one’s work on one’s behalf, one’s own ID and password for accessing the internal database were given to the colleague.BA memo of one’s own password for accessing the internal database was stuck on one’s own PC.CA document attached to an e-mail was imported into a PC. The password for viewing the document was given to a person who does not have the right to view the document.DAnother person’s ID and password registered on a popular shopping site were given to a third party without permission.

Explanation

Only D, passing on someone else’s ID and password — Japan’s Act on the Prohibition of Unauthorized Computer Access bans giving another person’s identification code to a third party without reason.

The Act covers computers whose use over a network is controlled by an identification code such as an ID and password. Besides unauthorized access itself, it prohibits obtaining, storing or phishing for another person’s code, and providing it to someone else without proper reason.

  • •A: the codes are one’s own, given by their legitimate user; against company rules, but not providing another person’s code.
  • •B: a note of one’s own password on the PC is careless, a matter for the security policy, not the Act.
  • •C: a document’s viewing password does not control access to a computer on a network, so the Act does not apply.
  • •D: another person’s ID and password given to a third party without permission: exactly the prohibited act.

Answer (d)

Why not others:

  • •(a) — adds A, B and C, poor practice but not acts under this Act
  • •(b) — adds A (one’s own codes) and C (a file password, not network access control)
  • •(c) — adds A: the Act covers providing another person’s code, not one’s own

Key rule: The Act on the Prohibition of Unauthorized Computer Access covers logging in with another person’s ID and password and the acts that prepare it: obtaining, storing, phishing for or providing someone else’s identification code.

Legal Affairs · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.