EXAM QUICK REFERENCE

Information Security Management (SG) exam quick reference

Turn security vocabulary back into a decision chain: what is protected, what may happen, where the weakness lies, and who should act. Section B applies that chain to longer cases.

Follows IPA Syllabus v4.1 and the current 120-minute, 60-question Sections A/B format.

Chapters: 12
Reference items: 72
Questions: 180
In-practice help: Ask Miko anytime

Question practice is open. These resources are available without signing in.

QUICK REFERENCE

Look up a term, grammar form, or method

Showing 60 items

Security goals and information assets

001CIAconfidentiality, integrity, availabilityEssential

Core note: The three core properties of information security: preventing unauthorized disclosure and alteration, and ensuring availability when needed.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

002情報資産information assetEssential

Core note: Information and related resources that have value to an organization and require protection.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

003情報セキュリティ目的information security objectiveEssential

Core note: Turns organizational policy into measurable security outcomes and indicators.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

004情報の分類information classificationEssential

Core note: Classifies information by sensitivity, business value, and legal requirements to set handling rules.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

005情報資産の管理責任者information asset ownerFrequent

Core note: Sets classification, access conditions, and protection requirements for an asset.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

006説明責任accountabilityFrequent

Core note: The ability to explain whether decisions, use of authority, and controls meet organizational requirements.
Exam area: Security goals and information assets
Decision focus: Name the asset before proposing a control.

Threats, vulnerabilities, and attacks

007脅威threatEssential

Core note: A potential cause that may exploit a weakness and cause harm.
Exam area: Threats, vulnerabilities, and attacks
Decision focus: Separate the attack technique from the weakness exploited.

008脆弱性vulnerabilityEssential

Core note: A weakness in an asset or control that a threat may exploit.
Exam area: Threats, vulnerabilities, and attacks
Decision focus: Separate the attack technique from the weakness exploited.

009マルウェアmalwareEssential

Core note: Software designed for malicious purposes such as destruction, theft, extortion, or unauthorized control.
Exam area: Threats, vulnerabilities, and attacks
Decision focus: Separate the attack technique from the weakness exploited.

011Webアプリケーション攻撃web application attacksFrequent

Core note: Exploits weaknesses in input validation, session management, or access control.
Exam area: Threats, vulnerabilities, and attacks
Decision focus: Separate the attack technique from the weakness exploited.

012攻撃対象領域attack surfaceFrequent

Core note: The collection of interfaces, accounts, services, devices, and supply-chain entry points exposed to attackers.
Exam area: Threats, vulnerabilities, and attacks
Decision focus: Separate the attack technique from the weakness exploited.

Cryptography and authentication

013多要素認証multi-factor authenticationEssential

Core note: Combining factors from different categories rather than simply asking for multiple factors of the same kind.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

014暗号化encryptionEssential

Core note: Protecting content confidentiality with keys; key management is also part of the control.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

015共通鍵暗号・公開鍵暗号symmetric and public-key cryptographyEssential

Core note: Symmetric cryptography uses one shared key; public-key cryptography uses a public/private pair.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

016ハッシュ関数hash functionEssential

Core note: Maps arbitrary-length data to a fixed-length digest, commonly for integrity checks.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

017ディジタル署名digital signatureEssential

Core note: Created with the signer's private key and verified with the matching public key to check integrity and key relationship.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

018ディジタル証明書・PKIdigital certificates and PKIFrequent

Core note: Certificates bind identities to public keys; PKI manages issuance, validation, and revocation.
Exam area: Cryptography and authentication
Decision focus: Map mechanisms separately to confidentiality, integrity, and identity assurance.

Networks and access control

019アクセス制御access controlEssential

Core note: Restricting use of resources according to identity, role, attributes, or rules.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

020ログlogFrequent

Core note: A time-ordered record of system or user activity used for monitoring, investigation, and audit.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

021ゼロトラストzero trustExtension

Core note: An approach that grants no automatic trust from network location and continually evaluates identity, device, and context.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

022最小権限の原則principle of least privilegeEssential

Core note: Grants only the smallest scope, shortest duration, and lowest privilege needed for a task.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

023ロールベースアクセス制御role-based access controlFrequent

Core note: Assigns permissions to roles and users to roles according to job responsibilities.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

024ネットワーク分離network segmentationFrequent

Core note: Separates networks by trust and use to limit lateral movement and impact.
Exam area: Networks and access control
Decision focus: Least privilege limits both scope and duration.

Risk assessment and treatment

025リスクriskEssential

Core note: The effect of uncertainty on objectives, often assessed in security through likelihood and impact.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

026リスク対応risk treatmentEssential

Core note: Handling risk through options such as avoidance, reduction, transfer, or acceptance.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

027リスク特定risk identificationEssential

Core note: Identifies assets, threats, vulnerabilities, existing controls, and possible consequences.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

028発生可能性・影響度likelihood and impactEssential

Core note: Combines likelihood and business impact to assess risk level.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

029リスク基準risk criteriaFrequent

Core note: Organizational criteria for comparing, prioritizing, and accepting risks.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

030残留リスクresidual riskEssential

Core note: Risk remaining after controls that must still be monitored or accepted.
Exam area: Risk assessment and treatment
Decision focus: Risk remaining after controls is residual risk.

ISMS and governance

031ISMSinformation security management systemEssential

Core note: A systematic way to manage information security through policy, risk management, controls, and continual improvement.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

032情報セキュリティ方針information security policyEssential

Core note: A top-level management statement of security direction, principles, and responsibilities.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

033継続的改善continual improvementFrequent

Core note: Improves ISMS suitability and effectiveness from monitoring, audits, incidents, and change.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

034適用宣言書statement of applicabilityEssential

Core note: States selected and excluded controls, the reasons, and implementation status.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

035マネジメントレビューmanagement reviewFrequent

Core note: Management periodically evaluates whether the ISMS remains suitable, adequate, and effective.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

036役割・責任・権限roles, responsibilities, and authoritiesFrequent

Core note: Clarifies who decides, performs, approves, and oversees to prevent gaps or conflicts.
Exam area: ISMS and governance
Decision focus: Governance sets direction; management carries it out.

Law, privacy, and compliance

037個人データpersonal dataFrequent

Core note: A statutory term under Japan's privacy law whose application must be judged from current law and the prompt's facts.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

038個人情報・個人データpersonal information and personal dataFrequent

Core note: The legal scopes differ and must be judged from the data's state and handling.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

039要配慮個人情報special care-required personal informationEssential

Core note: A statutory category including matters such as race, beliefs, and medical history that requires special care.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

040個人番号individual numberFrequent

Core note: An identifier in Japan's social security and tax system with special restrictions on collection, use, storage, and disclosure.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

041不正アクセス禁止法Unauthorized Computer Access LawFrequent

Core note: Regulates unauthorized access using another person's credentials and related facilitation.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

042守秘義務・秘密保持契約confidentiality duties and agreementsFrequent

Core note: Restricts use and disclosure of confidential information through law, employment, or contract.
Exam area: Law, privacy, and compliance
Decision focus: Identify actor, data category, and conduct in legal questions.

Outsourcing, cloud, and supply chain

043委託先管理supplier managementEssential

Core note: Outsourcing does not remove organizational responsibility; selection, contract, oversight, and exit controls remain necessary.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

044責任分界shared responsibility boundaryEssential

Core note: Clarifies which security duties belong to the customer, supplier, or cloud provider.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

045SLAservice level agreementFrequent

Core note: Agrees service quality metrics, measurement, reporting, and handling of missed targets.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

046サプライチェーンリスクsupply-chain riskEssential

Core note: Security risk introduced through third-party software, devices, services, or subcontracting.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

047委託先評価supplier assessmentFrequent

Core note: Assesses supplier controls, capability, incident history, and compliance before and during engagement.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

048契約終了時の管理exit managementFrequent

Core note: Revokes access and confirms return or deletion of data, assets, and records at contract end.
Exam area: Outsourcing, cloud, and supply chain
Decision focus: Outsourcing work does not automatically outsource accountability.

Incident response and continuity

049インシデントsecurity incidentEssential

Core note: One or more events that have compromised or may compromise information security.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

050BCPbusiness continuity planFrequent

Core note: A plan for continuing or restoring critical business operations during disruption.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

051CSIRTcomputer security incident response teamEssential

Core note: Coordinates incident intake, analysis, response, communication, and review.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

052インシデント対応手順incident response lifecycleEssential

Core note: Proceeds through preparation, detection, containment, eradication, recovery, and improvement.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

053証拠保全evidence preservationFrequent

Core note: Preserves logs, images, and records in a way that supports integrity and chain of custody.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

054BIA・RTO・RPOBIA, RTO, and RPOEssential

Core note: BIA identifies critical impacts; RTO targets recovery time and RPO targets the recovery point.
Exam area: Incident response and continuity
Decision focus: Plan both evidence preservation and timely recovery.

Monitoring and audit

055情報セキュリティ監査information security auditFrequent

Core note: An independent, objective evaluation of whether security controls conform to criteria and operate effectively.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.

056継続的監視continuous monitoringEssential

Core note: Continuously collects and evaluates events, configuration, vulnerabilities, and control performance.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.

057ログの完全性log integrityFrequent

Core note: Prevents unauthorized log alteration or deletion and preserves traceable time and source.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.

058監査証拠audit evidenceEssential

Core note: Sufficient, appropriate, and verifiable information supporting an audit conclusion.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.

059是正処置corrective actionFrequent

Core note: Eliminates the cause of a nonconformity to prevent recurrence.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.

060KPI・KRIKPI and KRIFrequent

Core note: KPIs track objectives and control performance; KRIs track changes in risk exposure.
Exam area: Monitoring and audit
Decision focus: Keep audit advice independent from operating the control.