Security
137 questions · IT Passport · 51–100
A private key and a public key were generated as a key pair and a digital certificate for the public key was issued. Which of the following is an appropriate action that should be taken when the private key is leaked?
Which of the following sets conditions for character type, length, etc. used for passwords that are set for accounts on a computer, etc.?
Among confidentiality, integrity, and availability, which of the following is the list that contains all and only the properties that are lost in the information security incident below?
All files on a server in the workplace were encrypted. However, the server was infected by a virus, and a number of the files were deleted. Removal of the virus and recovery of the files required several hours. During the hours, work could not be performed, and users were inconvenienced. Some files were unable to be recovered.
A problem has been pointed out that the WEP encryption for wireless LANs can be broken easily. Which of the following is an encryption method that does not have the same weakness and is cryptographically stronger?
Company A implements risk analysis for its own information assets. The results show that if a nearby river overflows, the server room on the first floor of the company might be flooded. The company considers the possibility of moving the server room, but decides there is almost no risk of a flood because the last time the river overflowed was 100 years ago, and the management decides that no particular countermeasures are taken. Which of the following is the risk treatment for information security that Company A selects?
The decision is made to digitize a paper-based contact list that only some people are permitted to view, and to manage it as a contact file. Among the measures A through D below, which of the following is the list that contains all and only the appropriate measures against personal information leakage?
Among the Web browsing practices (1) through (3) below, which of the following is the list that contains all and only the practices that reduce security risks?
Which of the following is placed between an internal network and an external network in order to prevent unauthorized access from the external network to the internal network?
Which of the following is an appropriate explanation of a keylogger that is a threat to information security?
Which of the following is a form of direct damage to a server that is caused by a DoS attack?
Among the countermeasures A through D concerning information security, which of the following is the list that contains all and only the appropriate countermeasures for virus infections?
Which of the following is the general name for evil-minded software such as a key logger or worm?
IDs and passwords are leaked from the first website, and the users of this website suffer from a password list attack on the second website. In this case, which of the following is the problem concerning the IDs and passwords for the second website?
Among the types of authentication I through IV, which of the following is a list that contains all and only biometrics authentication?
When information security management is based on the PDCA cycle, which of the following corresponds to C?
Which of the following is a protocol that is used for encrypted HTTPS communication between a web server and a web browser?
Which of the following is the most appropriate description concerning a VPN that is used, for example, to connect a PC to a workplace network from outside via the Internet?
Which of the following is an appropriate description concerning a virus check for an e-mail?
All employees are registered in an entry control system with biometric authentication, and the employees who are allowed to enter each room within the company are specified. The exit from a room is not controlled. Among the following lists of the descriptions A through D, which is the list that contains all and only the items that can be achieved by the entry control system?
Which of the following is the most appropriate description concerning an information security policy for an organization?
Which of the following is the most appropriate explanation of the operation that spyware is meant to perform?
Which of the following is an appropriate description of S/MIME that is used for e-mails?
The communication protocol between a web browser and a web server was changed from HTTP to HTTPS. Which of the following does this achieve?
In a file system that uses the access control methods below, which of the following settings for access rights to file A satisfies the requirements for access control?
*: Set –: Not set
Which of the following is an appropriate combination of terms or phrases to be inserted into A and B in the description below concerning identification of information security risks in ISMS?
A of ISMS, the risks that cause loss of confidentiality, B, or availability of information are identified.
In a corporate network, which of the following is a server that should be installed in a corporate LAN rather than in the demilitarized zone (DMZ)?
An IoT device with a vulnerability was used in large numbers by several companies. One (1) of the devices was infected with malware, and the infection spreads to many other IoT devices. On a certain date at a certain time, the many IoT devices that were infected with the malware attempted many connections to a certain website simultaneously, and this forced the service of the website to stop. Which of the following attacks was made against the website?
Which of the following is an appropriate explanation concerning proactive countermeasures against various threats that hinder stable operation of information systems?
Which of the following is an appropriate description concerning biometric authentication?
When a user accessed the URL in the body of an e-mail message with a PC, the message shown in the figure appeared on the screen and the PC was locked. Which of the following is used in this attack?
Which of the following is an appropriate example of activities conducted in A (Act) in the organizations that operate ISMS on the basis of the PDCA model?
It is reported that WEP suffers from the problem that ciphers are decoded in a short time. Which of the following is a stronger wireless LAN encryption method?
When a smartphone is used, which of the following is an appropriate preventive measure for shoulder surfing?
Which of the following is used to confirm that there is no falsification of the content of an e-mail?
Which of the following is not an appropriate security control concerning human resources as a security risk treatment in ISMS?
Among the following lists consisting of the information security terms availability, integrity, confidentiality, and vulnerability, which is a complete list of properties of information that information security is to preserve?
Which of the following is an appropriate description concerning a scheme for authenticating a user of a system?
Which of the following is the list that contains all appropriate features of chain mail?
One of the methods of cracking a password is a brute force attack that involves attempting all character combinations. When the number of characters of a password that is composed of 26 types of characters from A through Z is increased from four (4) to six (6) characters, by what factor is the maximum number of attempts to decode the password with the brute force attack increased?
In e-commerce transactions, which of the following is the most appropriate request to be made to the other party in order to prevent denial of the fact of order placement and details thereof?
Which of the following is the most appropriate combination of the measures against password theft and brute force attack respectively on websites having a login function?
Which of the following is the appropriate combination of terms or phrases to be inserted into blanks A and B in the description below concerning authentication accuracy in biometric authentication?
In biometric authentication, the probability of incorrectly rejecting the relevant person is called the false rejection rate, and the probability of incorrectly accepting another person is called the false acceptance rate. The rate that an authentication device or algorithm cannot recognize biometric information is called the unsupported rate.
In the settings for authentication accuracy, setting the A lower increases convenience, and setting B lower increases security.
The authentication technology is classified into three (3) types, namely authentication based on one’s possession, authentication based on physical characteristics, and authentication based on one’s memory. Which of the following is an appropriate combination of the implementation examples (1) through (3) and their classifications?
When information security measures are grouped into three (3) categories of technical security measures, human security measures, and physical security measures, which of the following is an appropriate example of physical security measures?
Which of the following is a technique for taking advantage of psychological weaknesses or carelessness in order to, for example, improperly obtain confidential information?
Which of the following is an appropriate description concerning password management?