IPA IP 2023 Question 90

A question IPA Japan published in 令和5年度 ITパスポート試験公開問題問90, translated into English. ITPEC is based on the same exams.

Which of the following is an appropriate example of implementing in the workplace a clear desk, which is a physical and environmental security control in information security?

a)Employees do not have fixed desks, and they carry out their work at vacant desks.b)One does not leave one’s seat with documents or other such items on which information is recorded left unattended on the desk.c)The LAN cables on the desks are removed, and an encrypted wireless LAN is used.d)When one leaves one’s seat, the PC is locked with a password.

Explanation

Not leaving documents on the desk when away — a clear desk means no information-bearing papers or media are left out unattended.

A clear desk policy requires that documents, USB memory and other media holding information are put away, for example in a locked drawer, whenever the user leaves the desk and at the end of the day. Otherwise anyone passing by can read, copy or take them. It is a physical and environmental control in ISO/IEC 27001, listed together with a clear screen.

Answer (b)

Why not others:

•(a) — working at any vacant desk is a free-address (hot-desking) office layout, a way of using space, not a security control
•(c) — replacing LAN cables with an encrypted wireless LAN is a network measure, not about what is left on the desk
•(d) — locking the PC with a password when leaving is a clear screen, the clear desk's companion for what is shown on the screen

Key rule: Clear desk = nothing with information left on the desk; clear screen = nothing readable left on an unattended PC screen.

Security · AI-written, may contain errors

Previous Next

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.