Introduction
Among the three domains of the IT Passport exam (Strategy, Management, and Technology), security is a theme whose share of questions has been rising in recent years. In this article, I have independently analyzed data from 28 past exams and am publishing a ranking of the TOP 30 terms that have actually appeared in the security domain.
Rather than a plain list of terms, I have organized this as theme-based groupings, question trends, and a key-term checklist, so please make use of it for efficient exam preparation.
An Overview of the Security Domain
Syllabus Ver. 6.5 defines 334 security-related terms, of which 124 are new terms. Across 28 past exams (2,800 questions), a total of 644 questions include a security-related term, meaning an average of 23 questions per exam relate to security.
Trend in the Number of Questions
The early-period average (H21–H23) was 17.7 questions per exam, but in recent years (R05–R07) it has risen to 26.7 questions per exam. The importance of the security domain is growing year by year.
Distribution by importance category:
- Most critical: 12 terms — terms you absolutely must memorize
- Important: 130 terms — terms with a high probability of appearing
- Formerly important: 14 terms — frequently tested in the past but not listed in the current syllabus
- Legacy terms: 178 terms — low test frequency but useful as related knowledge
Most-Tested Terms: TOP 30
Using the question data from 28 past exams, I ranked the security-domain terms by a weighted score (assigning higher weight to appearances in recent exams).
TOP 10
Ranks 11–20
Ranks 21–30
How to read this: The "number of appearances" is the cumulative count of times a given term appeared in the question text or answer choices. The more a term shows up across multiple questions in a single exam, the more it is being tested across a wide range of contexts.
Theme-Based Grouping
I have sorted the TOP 30 terms into five themes. Memorizing related terms as a set deepens your understanding.
1. Information Security Management
A group of terms related to the three elements of security (CIA) and the ISMS framework. On the exam, these appear in formats such as "List all three elements of information security" or "What is the purpose of an ISMS?"
2. Encryption and Key Technology
It is important to understand how public-key and common-key (symmetric) cryptosystems work, and the relationship between digital signatures and PKI. "Encryption" has appeared in all 28 exams and is the most frequently tested term in the security domain.
3. Authentication and Access Control
The "three factors of authentication (knowledge, possession, biometrics)" and combinations for multi-factor authentication appear frequently. The types of biometric authentication and how single sign-on works are also tested.
4. Defense and Countermeasures
Network defense technologies such as intrusion detection systems (IDS/IPS), firewalls, and DMZs are tested, along with operational aspects such as patch management and malware countermeasures.
5. Attack Methods
You are expected to understand the names and characteristics of attack methods. In particular, social engineering, phishing, and ransomware have been tested more often in recent years.
New Terms Worth Watching
Syllabus Ver. 6.5 added 124 new terms to the security domain. Although they have little track record in past exams so far, I have picked out important terms that are likely to be tested going forward.
New Terms Expected to Appear Going Forward
Study tip: New terms tend to be tested on their "outline and purpose." Memorize the full name behind each abbreviation, and make sure you can explain in one sentence what each technology achieves.
Key Term Checklist
From the TOP 30, I have gathered the especially important concepts into a checklist format you can review right before the exam.
The Three Elements of Security (CIA)
- Confidentiality: only authorized people can access it
- Integrity: the data has not been tampered with
- Availability: it can be used when needed
Encryption Basics
- Common-key (symmetric) cryptography: uses the same key for encryption and decryption (fast, but key distribution is a challenge)
- Public-key cryptography: uses a public key to encrypt and a private key to decrypt (easy key distribution)
- Digital signature: sign with the private key and verify with the public key (prevents spoofing and tampering)
- Hash function: generates a fixed-length value that cannot be reversed to the original data (tamper detection)
The Three Factors of Authentication
- Knowledge factor: passwords, PINs (information only the person knows)
- Possession factor: IC cards, one-time password generators (something only the person has)
- Biometric factor: fingerprints, iris, vein patterns (the person's physical traits)
- Multi-factor authentication: a method combining two or more of the above
Representative Attack Methods
- Phishing: lures victims to fake sites to steal personal information
- Social engineering: exploits people's psychological weaknesses to extract information
- Brute-force attack: tries every possible password by exhaustion
- Zero-day attack: exploits a vulnerability before a fix patch is released
- Ransomware: encrypts data and demands a ransom
- DDoS attack: shuts down a service with a flood of access
Defense Technologies
- Firewall: blocks unauthorized communication
- IDS/IPS: intrusion detection (detection only) / intrusion prevention (goes as far as blocking)
- DMZ: a buffer zone placed between the external and internal networks
- WAF: detects and prevents attacks against web applications
- Patch application: applies programs that fix vulnerabilities
Security Management
- ISMS: Information Security Management System (continuous improvement via PDCA)
- Risk assessment: identifies threats and vulnerabilities and evaluates risk
- Incident response: a CSIRT takes the lead in dealing with security incidents
Conclusion
The security domain has a large number of terms — 334 — but the terms that actually appear in past exams show a clear bias. If you study centered on the TOP 30 in this article, you can handle many of the security-related questions.
The following three points are especially important:
- Encryption is the most frequently tested in the security domain. Be sure to understand how public-key cryptography and digital signatures work.
- The three CIA elements (confidentiality, integrity, availability) are fundamental concepts tested in almost every exam.
- The names and characteristics of attack methods have been tested more often recently. Phishing, ransomware, and zero-day attacks are essential.
Before the exam, do a full review of your knowledge with the checklist and head into the test with confidence.