IPA IP 2024 Question 86

Topic: Security

A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問86, translated into English. ITPEC is based on the same exams.

Same question on ITPEC: Oct 2025 Q44

Which of the following is the appropriate example of activities performed in C (Check) in the organizations that operate ISMS on the basis of the PDCA model?

Explanation

Objectively evaluating the server administrator's work by a third party — an evaluation of how the ISMS is actually working belongs to Check.

In the PDCA model of an ISMS:

  • •Plan: identify the information assets, assess the risks, set the objectives and decide the measures
  • •Do: put the measures in place and operate them according to the procedures
  • •Check: monitor, measure and evaluate whether the measures work as intended, through internal audits, third-party reviews and management review
  • •Act: take corrective actions and improve, based on what Check found

A third party evaluating the administrator's work objectively measures the ISMS in operation without changing it, so it is Check.

Answer (c)

Why not others:

  • •(a) — changing the monitoring method as a corrective action, based on audit results, is Act
  • •(b) — identifying the assets to decide the measures and objectives is Plan
  • •(d) — watching the server according to the defined operational procedure is carrying out a measure day to day, which is Do

Key rule: Plan decides, Do carries out, Check evaluates the result against the plan, and Act corrects based on that evaluation; an action taken on audit results is Act, the audit itself is Check.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.