Security

Among the following items implemented in an ISMS, which of the following is performed first?

When information security measures are classified into “technical security measures,” “human security measures,” and “physical security measures,” which of the following is an appropriate example of “physical security measures”?

Which of the following is the term for replacing harmful character strings contained in the content that a user entered on a website with harmless character strings so as not to cause a malfunction in processing, which is used in countermeasures against SQL injection and other such attacks?

Which of the following is a cyber attack that has the characteristic of attacking a specific organization or individual continuously over a long period, for example by using multiple attack methods, for purposes such as obtaining confidential information?

Which of the following is the most appropriate description concerning the activities of an ISMS?

Which of the following is an appropriate description concerning internal audits in an ISMS?

Which of the following is the most appropriate example of an activity performed as a CSIRT?

Which of the following is an appropriate combination of terms to be inserted into blanks A and B in the description below concerning the false acceptance rate and the false rejection rate of biometric authentication?

In the authentication accuracy of biometric authentication, when an attempt is made to keep the false acceptance rate low, A becomes high, and when an attempt is made to keep the false rejection rate low, B becomes high.

Among the threats in information security, which of the following is the one for which applying a security patch that corrects a vulnerability to software is the most effective countermeasure?

Which of the following is the appropriate combination of descriptions concerning attacks that target web services and the names of the attacks?

Which of the following is an appropriate explanation of digital forensics?

Which of the following is a mechanism that detects unauthorized access and suspicious communication by monitoring networks and hosts, and reports them?

In an organization that adopts the PDCA model for the operation of ISMS, the following tasks concerning server monitoring are performed. Which of the following is the appropriate combination of each task and each phase of the PDCA model?

[Tasks]

Which of the following is an appropriate description concerning the information security policy in ISMS?

In PKI, there is a CRL as a list in which the information on digital certificates that meet a certain condition is published. Which of the following is the appropriate condition for being listed in this list?

When information security measures are classified into “technical security measures,” “human security measures,” and “physical security measures,” which of the following is an appropriate example of “physical security measures”?

Mr. A received the following four types of messages from Mr. B. Which of the following lists all and only the received messages that Mr. A can decrypt and read?

Which of the following is an appropriate description concerning security measures for a wireless LAN?

When risk treatment in risk management for information security is implemented by dividing it into the four (4) categories of risk transfer, risk avoidance, risk mitigation, and risk retention, which of the following is an appropriate description concerning these?

Which of the following is an appropriate example of a measure that reduces the damage when a PC used by an employee is infected with ransomware?

Which of the following is an appropriate description of a threat in information security?

In information security, which of the following lists all and only the events in which availability was impaired?

When the factors used for personal authentication are classified into the three (3) categories of knowledge, possession, and biometrics, which of the following is an example of authentication that uses possession as the factor?

Which of the following is used as a method for erasing all the data on an SSD so that it cannot be restored?

When the treatment of risks in information security risk management is classified into the four (4) categories of risk sharing, risk avoidance, risk retention, and risk mitigation, which of the following is an appropriate example of risk sharing?

Which of the following is an appropriate description concerning the role of a CA (Certificate Authority) in PKI?

Which of the following is an appropriate effect that is obtained by making the ESSID stealth?

Among the descriptions below, which of the following lists all and only the examples of biometric authentication?

Among the security measures for IoT devices, which of the following is the most appropriate as a countermeasure against social engineering?

Which of the following is the appropriate combination of confidentiality, integrity, and availability, which are the three elements of information security, and the examples A through C of measures for ensuring them?

In order to avoid using a program file of unknown origin, a user wants to investigate its publisher. Which of the following is the appropriate information to be checked in this case?

Which of the following is an appropriate description concerning the ISMS cloud security certification?

What is the general term for the content on the Internet that is not found by ordinary search engines and, because it is highly anonymous, is sometimes used for cyberattacks, trading of illegal goods, and other such things, and that may require special software to access?

Which of the following is an appropriate description of a WAF that is used as a security measure?

Which of the following is the most appropriate measure against information leakage when a PC that is no longer needed in the workplace is disposed of?

Among the tasks performed in formulating an information security policy at a company, which of the following is an appropriate order of implementation of the tasks below?

Which of the following is an appropriate description concerning ISMS cloud security certification?

Among security measures in IoT devices, which of the following is an appropriate measure that gives tamper resistance?

Which of the following is an attack in which unauthorized software is planted on a website or other such place, and when the site is accessed from the web browser of a PC, smartphone, or other such device, malware is sent in by exploiting a vulnerability of the web browser or other such software without the user noticing?

What is a measure called that is regarded as a basic principle in the design, construction, and operation of IoT systems and other such systems, and ensures information security from the planning and design stages of the system?

Authentication factors in information security can be classified into three (3) types. Which of the following is the appropriate set of the three (3) types of authentication factors?

Which of the following is an appropriate description of the PSK that is set when a PC is connected to a wireless LAN router by using WPA2, a security standard for Wi-Fi?

Which of the following is an appropriate role of an IDS that is used in a network environment?

In the activities of an organization that operates an ISMS on the basis of the PDCA model, the following investigation report was made. In which process of the PDCA model is this investigation performed?

Concerning the receipt of e-mail from outside the company, a malware detection system has been introduced in accordance with the information security policy and is maintained and operated, and it achieves the effect of detecting and discarding dozens of received e-mails with malware attached every day. However, there are no rules or clear operating procedures for security measures concerning the sending of e-mail outside the company, and there is a risk that an incident such as the mistaken sending of an e-mail with company-confidential material attached to an address outside the company may occur.

When an HDD is disposed of, which of the following lists all and only the appropriate measures for preventing information leakage from the HDD?

Which of the following is an appropriate description concerning an e-mail to which the sender’s digital signature that uses a message digest is attached?

A message is to be sent by using a hybrid encryption method. In the figure that shows the procedure for encrypting the message and the key for decryption, when the key used for encrypting the message is (1) and the key used for encrypting (1) is (2), which of the following is the appropriate combination of words to be inserted into A and B in the figure?

Which of the following is an attack that does not use technical methods, such as impersonating an employee of a company to obtain an ID or a password, or obtaining confidential information from a wastebasket?

Which of the following is an appropriate example of implementing in the workplace a clear desk, which is a physical and environmental security control in information security?

Which of the following is an appropriate description concerning the information security policy in ISMS?