Comparing risk rating against appetite is the most helpful criterion when prioritizing action plans for identified risk, as it helps to determine the urgency and importance of addressing the risk. Risk rating is the level of risk after considering the likelihood and impact of a risk event, and risk appetite is the amount and type of risk that an organization is willing to accept in pursuit of its objectives. By comparing risk rating against appetite, an organization can identify which risks are above, within, or below its tolerance level, and prioritize the action plans accordingly. Risks that are above the appetite level should be treated with the highest priority, as they pose a significant threat to the organization's objectives and performance. Risks that are within the appetite level should be monitored and controlled regularly, as they are acceptable but still require attention. Risks that are below the appetite level should be reviewed periodically, as they are negligible or insignificant.
References:
*ISACA, Risk IT Framework, 2nd Edition, 2019, p. 751
*ISACA, Tips for Prioritizing Risk in Your Risk Register2

は誤りです。誰かが会社の秘密の計算式やパスワードを見た場合、機密性が失われます。

To ensure IT asset protection, having procedures for risk assessments on IT assets is the most important. These procedures enable an organization to systematically identify, evaluate, and mitigate risks associated with its IT assets. This process is crucial for understanding the vulnerabilities and threats that could potentially harm the assets and for implementing the necessary controls to protect them.
* Procedures for Risk Assessments on IT Assets (Answer A):
* Importance: Regular risk assessments help in identifying vulnerabilities and threats to IT assets, allowing the organization to prioritize and implement appropriate risk mitigation strategies.
* Implementation: These procedures should be well-documented and regularly updated to reflect the changing threat landscape and the organization's evolving IT infrastructure.
* Outcome: Effective risk assessments ensure that IT assets are protected from potential risks, thereby safeguarding the organization's data, systems, and overall IT environment.
* Comparison with Other Options:
* B. An IT asset management checklist:
* Purpose: This helps in tracking and managing IT assets.
* Limitation: It does not address risk assessment and mitigation directly.
* C. An IT asset inventory populated by an automated scanning tool:
* Purpose: Provides a detailed list of IT assets.
* Limitation: While it helps in knowing what assets exist, it does not assess the risks associated with those assets.
* D. A plan that includes processes for the recovery of IT assets:
* Purpose: Focuses on recovery after an incident.
* Limitation: It is reactive rather than proactive in protecting assets.
References:
* ISACA CRISC Review Manual, Chapter 2, "IT Risk Assessment", which emphasizes the need for systematic risk assessments to manage and protect IT assets effectively.

セクション: 巻 B
Explanation:
ウェブサイトの改ざんとは、サイトやウェブページの外観を変更する、権限のない第三者によるウェブサイトへの攻撃です。これは通常、ウェブ サーバーに侵入し、ホストされているウェブサイトを自分のウェブサイトに置き換えるシステム クラッカーの仕業です。
誤った回答:
A: Ping フラッディングは、1 秒あたり数千または数百万の ping を送信する極端な方法です。Ping フラッディング攻撃により、システムが遅くなったり、サイト全体がシャットダウンしたりする可能性があります。
C: サービス拒否攻撃 (DoS 攻撃) は、コンピュータまたはネットワーク リソースを、その対象ユーザーが使用できないようにする攻撃です。一般的な攻撃方法の 1 つは、外部通信要求でターゲット マシンを飽和状態にし、正当なトラフィックに応答できないようにするか、応答が遅くなって事実上使用できなくなるようにすることです。
D: FTP バウンス攻撃は、アプリケーションベースのファイアウォールをすり抜ける攻撃です。この攻撃では、ハッカーは FTP サーバーにファイルをアップロードし、このファイルを内部サーバーに送信するように要求します。このファイルには、内部サーバーを占有してすべてのメモリと CPU リソースを使い果たす悪意のあるソフトウェアまたは単純なスクリプトが含まれている場合があります。