IPA IP 2024 Question 94
A question IPA Japan published in 令和6年度 ITパスポート試験 公開問題 問94, translated into English. ITPEC is based on the same exams.
Among the tasks performed in formulating an information security policy at a company, which of the following is an appropriate order of implementation of the tasks below?
Explanation
A → B → C → D — first decide who does the work, then the basic policy, then identify the information assets, and then analyze their risks.
Nothing can be drafted before someone is responsible for it, so the work starts by appointing the person responsible and the persons in charge (A). The basic policy, management's statement of the company's stance and objectives for information security, comes next (B) and gives the direction for the rest. Under it the company identifies and classifies the information assets it holds (C). Risks can only be analyzed for known assets: risk analysis asks, for each asset, what threats and vulnerabilities it faces and how serious the damage would be (D). Its results then shape the standards and procedures under the basic policy.
Answer (a)
Why not others:
- •(b) — analyzes risks before the assets are identified, but a risk analysis needs the list of assets to work on
- •(c) and (d) — formulate the basic policy before anyone is responsible for formulating it
Key rule: A security policy is built in a fixed order: the people, then the direction (basic policy), then the assets, then their risks, and only then the countermeasures.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.