IPA IP 2026 Question 92
A question IPA Japan published in 令和8年度 ITパスポート試験 公開問題 問92, translated into English. ITPEC is based on the same exams.
Which of the following is an appropriate example of an information security measure based on the concept of zero trust security?
Explanation
Two-factor authentication for every access, internal or external — zero trust grants no trust because of where an access comes from.
Zero trust drops the old assumption that the inside of the network is safe. Every access to an information resource is treated as untrusted and verified each time, from the internal network as much as from the Internet: the user is authenticated strongly (for example with two factors), the device's state is checked, and only the access needed is granted.
Option (b) applies the same strong authentication whether the access starts inside or outside the network, which is exactly that principle.
Answer (b)
Why not others:
- •(a) — a firewall at the Internet boundary is perimeter defence, the model zero trust replaces: whatever is already inside is trusted
- •(c) — applying patches promptly is good vulnerability management, but it says nothing about how each access is verified, so it is not what makes a measure zero trust
- •(d) — protecting only the PCs that reach the Internet assumes the other internal PCs are safe, the very inside-is-trusted assumption zero trust rejects
Key rule: Zero trust means "never trust, always verify": a request earns no trust from its network location, so every access is authenticated and authorized.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.