IPA IP 2025 Question 68
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問68, translated into English. ITPEC is based on the same exams.
Which of the following is the most appropriate example of an activity performed as a CSIRT?
Explanation
Investigating the impact of a security incident and supporting countermeasures against its spread — a CSIRT is the team that responds to computer security incidents.
CSIRT stands for Computer Security Incident Response Team. When an incident such as a malware infection or unauthorized access occurs, the CSIRT receives the report, analyzes what happened and how far it reaches, supports the containment and recovery measures that stop the damage from spreading, and coordinates with outside parties such as other CSIRTs. Between incidents it collects threat information and prepares the response.
Answer (c)
Why not others:
- •(a) — regularly applying security patches is routine vulnerability management by system operators, a preventive task rather than incident response
- •(b) — a company-wide business continuity plan for natural disasters is drawn up by management for the whole business (BCP), not by a CSIRT
- •(d) — checking whether entry and exit records were kept properly is an audit, done by auditors independent of the operation
Key rule: CSIRT = incident response: receive, analyze, contain and coordinate when a security incident occurs.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.