問68
頻出度★★★
ネットワークにおいて，外部からの不正アクセスを防ぐために内部ネットワークと外部ネットワークの間に置かれるものはどれか。
平成22年度 春期 ITパスポート試験 問68
This question's explanation and your answers so far.
解説
問 68
Incorrectア
A DNS server performs name resolution: it maps domain names such as www.example.co.jp to IP addresses and back. Its role is to provide the information needed to find out where communication should go; it has no function for permitting or blocking packets in order to prevent unauthorized access. A DNS server for external publication may be placed in a DMZ, but there it is on the protected side — it is not itself the mechanism that guards the boundary.
Incorrectイ
A search engine is a service that collects and indexes information on the Web and finds and presents web pages matching a user's keywords. It is a tool for searching for information on the Internet; it is neither a device installed at the boundary of a network nor a mechanism that controls access.
Incorrectウ
A switching hub (a layer 2 switch) is a concentrator used mainly within a single LAN. It looks at the destination MAC address of each frame and forwards it only to the port that needs it, which improves communication efficiency. It does have the effect of reducing unnecessary forwarding, but that is for better performance; it is not a security function that judges and blocks unauthorized access from the outside on the basis of rules.
- エ
正解 The correct answer is エ, the firewall. A firewall is placed at the boundary between an internal network, such as a company LAN, and an external network, such as the Internet. It checks the packets that pass through it — their source and destination IP addresses, their port numbers (the type of communication), and so on — against rules decided in advance (an access control list), letting through only the communication that is permitted and blocking the rest. The condition given in the question, “something placed between the internal network and the external network in order to prevent unauthorized access from the outside”, that is, the role of sitting at the boundary and filtering communication, applies directly to the firewall alone. Note that web servers and mail servers published to the outside are commonly placed in a DMZ (demilitarized zone), a buffer area separated from the internal network by the firewall, so that even if a published server is compromised, the damage does not reach the inside.
ここがポイント
- Firewall = a boundary-defense mechanism installed at the border between an internal network and an external network, permitting or blocking communication according to conditions such as IP addresses and port numbers. When keywords like “placed between the inside and the outside” and “prevent unauthorized access” appear, the answer is the firewall.
- As a related configuration, learn the DMZ (demilitarized zone). Servers published to the outside (web, mail, public DNS, and so on) are placed in a segment isolated from the internal network by the firewall, so that even if a published server is compromised, the damage does not spread inside. A DNS server, a search engine, and a switching hub each carry out a different role — name resolution, information search, and forwarding within a LAN.
用語