IPA IP 2026 Question 100

A question IPA Japan published in 令和8年度 ITパスポート試験公開問題問100, translated into English. ITPEC is based on the same exams.

Which of the following is the most appropriate description concerning the activities of an ISMS?

a)Business processes are improved for purposes such as reducing the costs of a company and improving the quality of products and services.b)The quality of IT services is continuously improved in order to increase customer satisfaction.c)Information assets are identified, the risks are identified, analyzed, and evaluated, and the information assets are managed.d)The maturity of the development processes of products and services is evaluated and improved.

Explanation

Identifying information assets, then identifying, analyzing and evaluating their risks to manage them — this is the core activity of an ISMS.

An ISMS (information security management system, ISO/IEC 27001) protects the confidentiality, integrity and availability of an organization's information. It runs as a PDCA cycle: list the information assets in the scope, identify, analyze and evaluate the risks to them (risk assessment), decide how to treat each risk, then operate the controls, check them and improve.

Answer (c)

Why not others:

•(a) — improving business processes for cost, quality and service is BPR or BPM, aimed at the business, not at information security
•(b) — continually improving the quality of IT services for customer satisfaction is IT service management (ISO/IEC 20000)
•(d) — evaluating and improving the maturity of development processes is CMMI

Key rule: Match the management system to what it manages: information security is ISMS (ISO/IEC 27001), IT services are ITSM (ISO/IEC 20000), development processes are CMMI, product quality is a QMS (ISO 9001).

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.