問79
頻出度★★★
ファイアウォールを設置することで, インターネットからもイントラネットからもアクセス可能だが, イントラネットへのアクセスを禁止しているネットワーク上の領域はどれか。
平成21年度 秋期 ITパスポート試験 問79
This question's explanation and your answers so far.
解説
問 79
Incorrectア
DHCP (Dynamic Host Configuration Protocol) is a protocol that automatically distributes configuration information such as IP addresses, subnet masks, and default gateways to devices connected to a network. It is not the name of an area on a network, and it has nothing to do with access control.
- イ
正解 The correct answer is イ, DMZ (DeMilitarized Zone). A DMZ is an intermediate area separated by a firewall from both the external network on the Internet side and the company's internal intranet, and it is where public Web servers, mail servers, externally published DNS servers, and the like are placed. Looking at the direction of communication, Internet to DMZ and intranet to DMZ are both permitted, but DMZ to intranet is prohibited. With this arrangement, even if a public server in the DMZ is taken over, it prevents attackers from using it as a stepping stone to break into the internal network. The condition in the question, that the area can be accessed from both sides but is prohibited from accessing the intranet, describes exactly this design, so the answer is DMZ.
Incorrectウ
DNS (Domain Name System) is a name resolution mechanism (service) that converts between domain names and IP addresses. A DNS server may indeed be placed in a DMZ, but DNS itself is not a term for an area, so this is wrong.
Incorrectエ
DoS (Denial of Service) is the name of an attack that sends huge numbers of packets or requests to force a server out of service. It is an attack technique, not a network area partitioned off by a firewall.
ここがポイント
- A DMZ is a buffer area isolated by a firewall from both the internal network and the external network. Public servers are placed there, and communication from the DMZ to the intranet is blocked, which prevents damage from spreading if a public server is compromised.
- Telling the confusable three-letter abbreviations apart: DHCP is the protocol that automatically distributes IP addresses, DNS is the name resolution mechanism, DoS is a denial-of-service attack, and DMZ is a network area.
用語