EXAM QUICK REFERENCE
Turn security vocabulary back into a decision chain: what is protected, what may happen, where the weakness lies, and who should act. Section B applies that chain to longer cases.
Follows IPA Syllabus v4.1 and the current 120-minute, 60-question Sections A/B format.
Question practice is open. These resources are available without signing in.
QUICK REFERENCE
Showing 6 items
初動の優先順位
Choose the first action from safety, spread, evidence loss, and business interruption.
Check whether impact is still spreading.
Assess whether evidence may be lost.
Choose an authorized action that can be taken now.
A complete fix may not be the first action; address the most urgent current risk.
最小権限の判断
Assess access from business need, scope, duration, and review.
Confirm the task actually needs the access.
Narrow resources, actions, and duration.
Add approval, logging, and periodic review.
Convenience alone does not justify broader privilege.
インシデント初動
Choose the appropriate first move among reporting, isolation, preservation, repair, and recovery.
Identify the reporting route from the plan.
Contain impact within authorized scope.
Preserve records before and after action.
Unauthorized system changes may increase damage or destroy evidence.
リスク対応の選択
Choose avoidance, reduction, transfer, or acceptance from risk, cost, objectives, and legal constraints.
Confirm current risk and acceptance criteria.
Compare effects and side effects of treatments.
Check residual risk after treatment.
Risk transfer does not transfer all accountability.
委託・クラウド対応
Judge controls from responsibility boundaries, contracts, oversight, incident reporting, and exit conditions.
Draw both parties' responsibility boundary.
Check whether the contract covers key requirements.
Verify monitoring, reporting, and exit procedures.
Provider controls do not remove the customer's selection and oversight duties.
法令の適用判断
Assess legal applicability from actor, information category, conduct, purpose, and exceptions.
Identify the actor and information category.
Identify collection, use, disclosure, or other conduct.
Check purpose limits, consent, and exceptions.
Do not choose a rule from a keyword alone; verify every applicability condition.
