PracticeVideosBlogFlashcardsEspañol
All Practice Exams

Free Practice Questions for Information Security Management Examination

Exam-style questions and explanations by OpenExamPrep.

✓ No registration✓ No credit card
100+ Questions
100% Free

Loading practice questions...

Same family resources

Explore More Japan Information Technology Engineers Examination (IPA)

Continue into nearby exams from the same family. Each card keeps practice questions, study guides, flashcards, videos, and articles in one place.

Applied Information Technology Engineer Examination (応用情報技術者試験, Japan)

Practice Questions

Database Specialist Examination (データベーススペシャリスト試験, Japan)

Practice Questions

Embedded Systems Specialist Examination (エンベデッドシステムスペシャリスト試験, Japan)

Practice Questions

Fundamental Information Technology Engineer Examination (基本情報技術者試験, Japan)

Practice Questions

Information Technology Passport Examination (ITパスポート試験, Japan)

Practice Questions

Information Technology Service Manager Examination (ITサービスマネージャ試験, Japan)

Practice Questions
Exam Review

Key Facts: Information Security Management Examination Exam

7,500 JPY

Exam fee (tax included)

IPA スケジュール、手数料など

600/1000 IRT

Combined Subject A/B pass cutoff

IPA 試験要綱 Ver.5.6

60 MCQs / 120 min

Official sitting (48 A + 12 B)

IPA SG / 試験要綱 Ver.5.6

Level 2

IT Skill Standards (ITSS) ranking

IPA 情報セキュリティマネジメント試験シラバス（レベル2）

Japan's national ITSS Level 2 information-security management exam, run by IPA for METI. Fee 7,500 JPY (tax included); Japanese CBT, 60 MCQs in 120 minutes, IRT 600/1000. This bank is independent English MCQ study, not an official translation.

Sample Information Security Management Examination Practice Questions

Try these sample questions to review concepts for the Information Security Management Examination exam. Each question includes a detailed explanation. Start the interactive quiz above for the full 100+ question experience with AI tutoring.

1A user-department security leader is classifying a customer contract file. Which property of information security is lost if an unauthorized contractor can read the file but cannot change or delete it?
A.Confidentiality (機密性)
B.Integrity (完全性)
C.Availability (可用性)
D.Non-repudiation (否認防止)
Explanation: Confidentiality is the property that information is not disclosed to unauthorized persons, entities, or processes. Unauthorized reading of a contract file is a confidentiality failure even when the file is not altered or made unavailable. Integrity concerns unauthorized modification, availability concerns timely usable access, and non-repudiation concerns proof of origin or receipt.
2Which situation is primarily a loss of integrity rather than confidentiality or availability?
A.A ransomware lock prevents staff from opening the shared drive during business hours
B.An attacker silently changes unit prices in an order spreadsheet before it is approved
C.A visitor photographs a printed customer list left on a meeting-room table
D.A power outage takes the departmental file server offline for two hours
Explanation: Integrity is the property of accuracy and completeness. Unauthorized alteration of unit prices changes the information without necessarily disclosing it or taking it offline. Photographing a list is a confidentiality failure; ransomware lockout and a power outage are availability failures.
3In addition to confidentiality, integrity, and availability, the IPA SG syllabus lists authenticity, accountability, non-repudiation, and reliability. Which statement correctly describes authenticity (真正性)?
A.Users can obtain the service within an agreed response time even after a disk failure
B.An action can be traced uniquely to a person or process so that responsibility can be assigned
C.An entity is confirmed to be what it claims to be, such as a genuine sender or a genuine message
D.A party cannot later deny having sent or approved a message that used its signature key
Explanation: Authenticity is the property that an entity is what it claims to be. Typical examples are confirming a genuine user, device, or message origin. Accountability is traceability to an actor, non-repudiation prevents later denial of an action, and timely service after failure is availability (often supported by reliability measures).
4A department is rating the value of an information asset from the three CIA aspects. Which rating approach matches the SG skill of clarifying asset value?
A.Use only the purchase price of the server hardware as the asset value
B.Rate availability only, on the assumption that a file nobody can open cannot be disclosed
C.Assign the same value to every file because all departmental data is stored on one file server
D.Rate confidentiality, integrity, and availability separately, then use those ratings to express importance
Explanation: SG Subject B skills require identifying departmental information assets and clarifying their value (importance) from confidentiality, integrity, and availability. Hardware cost alone ignores information value; storing files on one server does not make their CIA needs identical.
5Which pairing of a threat and a vulnerability is the most accurate description of how a password-list (credential-stuffing) attack succeeds?
A.Threat: reused leaked identifier/password pairs; vulnerability: the service accepts those pairs without extra authentication
B.Threat: an unpatched buffer overflow; vulnerability: users choosing long unique passwords
C.Threat: a fire in the server room; vulnerability: missing UPS equipment
D.Threat: a DDoS flood; vulnerability: missing disk encryption on laptops
Explanation: A threat is a potential cause of an unwanted incident; a vulnerability is a weakness that a threat can exploit. Credential stuffing uses identifier/password pairs leaked from elsewhere (threat) against a service that still accepts those reused credentials without additional checks (vulnerability). The other pairings mix unrelated threats and weaknesses.
6IPA's internal-fraud guidance uses the fraud triangle (不正のトライアングル). Which set is the three elements?
A.Confidentiality, integrity, and availability
B.Opportunity, motivation (incentive), and rationalization (justification)
C.Identify, protect, and detect
D.Prevention, detection, and correction
Explanation: The fraud triangle used in IPA's 組織における内部不正防止ガイドライン and the SG syllabus consists of opportunity, motivation (incentive), and rationalization (justification). Reducing any leg—especially opportunity through access control and monitoring—lowers internal-fraud risk. CIA, CSF functions, and control types are different models.
7Which malware type encrypts business files and demands payment, and in its double-extortion (二重脅迫) form also threatens to leak stolen data?
A.Spyware that only records keystrokes
B.A worm whose only action is self-replication across file shares
C.Ransomware (ランサムウェア)
D.A macro virus that displays a harmless joke message
Explanation: Ransomware encrypts or otherwise denies access to data and demands ransom. Double extortion adds theft and a leak threat (leak sites). Keyloggers/spyware, self-replicating worms, and joke macros are different malware classes in the SG syllabus.
8A PC appears idle, but outbound traffic goes to an unknown host that later issues commands to the PC. Which description matches this pattern in the SG syllabus?
A.The pattern is a fail-safe hardware interlock in the server room
B.The traffic is ordinary DHCP renewal with the local router
C.The host is performing cryptographic erase of its own disk
D.The PC is likely part of a botnet using a remote-access Trojan (RAT) and a C&C server
Explanation: Bots in a botnet (ボットネット) often use a RAT (遠隔操作型ウイルス) and receive instructions from a C&C (command-and-control) server. Idle appearance with unexplained outbound command traffic is a classic bot/RAT pattern, not DHCP, cryptographic erase, or physical interlock.
9Which statement best describes fileless malware (ファイルレスマルウェア) as listed in the SG syllabus?
A.It operates mainly in memory or via legitimate system tools, leaving little traditional file evidence
B.It always requires a malicious .exe file stored permanently in the Program Files directory
C.It is another name for a paper document left on a clear-desk violation
D.It can infect only air-gapped machines that have no RAM
Explanation: Fileless malware runs primarily in memory or abuses legitimate tools (for example PowerShell or WMI), so conventional file-hash antivirus may miss it. It is not defined as a stored .exe, a paper-document issue, or something that requires the absence of RAM.
10An attacker tries leaked email/password pairs from Site A against the department's webmail. What attack is this, and how does it differ from a classic dictionary attack?
A.SQL injection; it sends database commands instead of passwords
B.A password-list (credential-stuffing) attack; it reuses real leaked pairs rather than guessing from a word list
C.DNS cache poisoning; it forges resolver answers
D.A reverse brute-force attack; it always uses one password against every account without leaked pairs
Explanation: A password-list attack (パスワードリスト攻撃 / credential stuffing) replays identifier/password pairs stolen from another service, exploiting password reuse. A dictionary attack guesses from a word list and need not use actual leaked pairs. SQL injection and DNS poisoning are different techniques.

About the Information Security Management Examination Exam

The Information Security Management Examination (情報セキュリティマネジメント試験, SG) is Japan's national ITSS Level 2 exam for user-department security leaders. IPA administers it for METI. The 2026 fee is 7,500 JPY (tax included). Candidates sit Japanese CBT: 60 MCQs (48 Subject A and 12 Subject B) in 120 minutes, scored with IRT. A pass requires 600 of 1,000. This is not the Level 4 Registered Information Security Specialist (SC) examination. OpenExamPrep publishes 100 independent English multiple-choice study questions on the published syllabus. This bank is not an official translation, not a 2026 CBT item clone, and not a substitute for Japanese practice.

Exam sponsor: 独立行政法人情報処理推進機構 (IPA / Innovation Platform Agency, Japan) under the Ministry of Economy, Trade and Industry (METI). The requirements and fees below concern the certification or admission exam, separate from our free practice resources.

Assessment

Japanese year-round CBT. Subject A and Subject B are taken in one session. IRT composite scoring. Live SG questions are unpublished; paper sittings are a special measure only.

Time Limit

120 minutes (Subject A and Subject B together)

Passing Score

IRT composite 600 of 1,000 on the combined sitting.

Exam / Certification Fees

7,500 JPY (tax included).

Exam sponsor website

Fees, eligibility, and exam policies can change. Confirm them with the exam sponsor before applying or paying.

Official sources

Our practice resources: topics covered

We aim to reflect publicly available exam outlines and topic information in our study resources. Coverage, format, and difficulty may differ from the actual exam, and we cannot guarantee that every detail is accurate or current. Confirm exam requirements, fees, and policies with the official exam sponsor.

25% of this local practice set

Information security concepts and attacks

CIA, threats, vulnerabilities, attack methods, cryptography, and authentication. IPA does not publish SG domain percentages.

25% of this local practice set

Information security management and ISMS

Assets, risk treatment, JIS Q 27000-series / ISO/IEC 27000-series management, incidents, and CSIRT.

25% of this local practice set

Controls, awareness, and operations

Malware, access control, leakage prevention, education, cloud use, and supplier management used in Subject B cases.

25% of this local practice set

Japanese security law and related IT knowledge

Cybersecurity Basic Act, APPI, Unauthorized Computer Access Act, and supporting network, audit, and management topics. Syllabus Ver.4.1 replaces プロバイダ責任制限法 with 情報流通プラットフォーム対処法.

Preparing for the Information Security Management Examination Exam

What You Need to Know

  • Passing score: IRT composite 600 of 1,000 on the combined sitting.
  • Assessment: Japanese year-round CBT. Subject A and Subject B are taken in one session. IRT composite scoring. Live SG questions are unpublished; paper sittings are a special measure only.
  • Time limit: 120 minutes (Subject A and Subject B together)
  • Exam / certification fees: 7,500 JPY (tax included). Official sources

Using Our Practice Resources

  • Work through all 100 available questions
  • Review every answer and explanation
  • Track weak areas and revisit them
  • Use our AI tutor for tough concepts

Information Security Management Examination: Suggested Study Strategy

1Treat this English bank as knowledge and scenario practice; official SG papers are Japanese and live CBT items are unpublished.
2Memorize risk treatment options, ISMS PDCA, and JIS Q 27001-style control intent rather than vendor product trivia.
3Confirm Japanese statutes from e-Gov or IPA syllabus wording: APPI, Unauthorized Computer Access Act, and Cybersecurity Basic Act recur.
4Practice workplace cases (asset inventory, supplier contracts, incident first response) that match Subject B's case style.
5Do not confuse SG with SC; the latter adds specialist cryptography, network defense, and a descriptive paper.

Frequently Asked Questions

What is the passing score for the SG examination?

IPA scores the combined Subject A and Subject B sitting with IRT. A composite of at least 600 of 1,000 is required (試験要綱 Ver.5.6).

Is SG the same exam as 情報処理安全確保支援士 (RISS / SC)?

No. SG is the Level 2 Information Security Management Examination for user-department leaders. SC is the separate Level 4 Registered Information Security Specialist Examination; using the protected title requires a later IPA registration after an SC pass.

How is the 2026 examination delivered?

Year-round Japanese CBT: 60 MCQs in 120 minutes (48 Subject A and 12 Subject B). Live items are unpublished. Paper sittings are only a special measure.

Are these OpenExamPrep practice questions official IPA exam questions?

No. The official examination is administered in Japanese by IPA. OpenExamPrep provides an independent English-language MCQ practice bank on published syllabus topics. It is not an official translation, endorsement, or substitute for Japanese SG items.

Is the exam changing after 2026?

IPA states that the current examination system ends with the FY2026 (令和8年度) administration and that a new examination system is planned from FY2027, following the METI/IPA review of the exam-division structure. FY2026 is also the year every division moved to CBT, and IPA no longer publishes live CBT questions. This practice set is built from the current published syllabus, so confirm IPA's 試験制度の見直し page before planning a sitting beyond FY2026.