IPA IP 2025 Question 92
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問92, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate example of a measure that reduces the damage when a PC used by an employee is infected with ransomware?
Explanation
Regular backups kept off the network — once ransomware has encrypted the files, an intact copy it could not reach is what limits the damage.
Ransomware encrypts files on the infected PC and on every drive and file server the PC can write to, then demands a ransom for the key. A backup that stays connected can be encrypted too. A backup taken periodically and stored disconnected from the network stays out of its reach, so the files can be restored without paying, losing only the changes since the last backup.
Answer (a)
Why not others:
- •(b) — multi-factor authentication makes unauthorized login harder; it does nothing once malware runs under the legitimate user's session
- •(c) — encrypting the HDD protects the data if the PC is lost or stolen; ransomware running on the unlocked PC can still read and encrypt the files
- •(d) — locking the ID after repeated wrong passwords stops password guessing, not malware already on the PC
Key rule: Against ransomware, the damage-limiting measure is an offline (network-isolated) backup that can be restored; access controls only help to prevent intrusion.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.