問61
頻出度★★★
ウイルス対策ソフトに関する記述 a～c のうち, 適切なものだけを全て挙げたものはどれか。 a USB メモリから感染するタイプのウイルスを検知できるものがある。 b 定期的にウイルス対策ソフトとウイルス定義ファイルの更新を行っていても, ウイルスを検知できないことがある。 c ボットウイルスを検知できるものがある。
平成23年度 秋期 ITパスポート試験 問61
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 61
Incorrectア
a and b are indeed appropriate, but this option is wrong in excluding c. The bot in c is a malicious program that makes an infected PC remotely controllable from a command server, and as a kind of malware it is included among the detection targets of ordinary antivirus software. Products that can actually detect and remove bots exist, so there is no reason to exclude c as inappropriate. This option therefore is not a combination that lists all and only the appropriate statements.
- イ
正解 The correct answer is イ. Statements a, b, and c are all appropriate, so the combination that lists all of them, “a, b, c”, is the answer. About a: viruses that spread via USB memory really do exist. A typical example is the type that abuses the auto-run setting (autorun.inf) on a USB memory device so that a malicious program starts just by plugging the device into a PC. Some antivirus products have a function that automatically inspects the contents of removable media the moment they are connected, or a real-time scan function that inspects files every time they are accessed, and these can detect infections that arrive through USB. The statement that “some can detect them” is therefore correct. About b: the central detection method of antivirus software is pattern matching, which compares the item being inspected against the characteristics of known viruses registered in the virus definition file (pattern file, signature). A definition file is created and distributed only after a new virus has been discovered and analyzed, so in principle it cannot handle a virus before that discovery, or before the file has been distributed. In other words, no matter how diligently a user updates the software itself and the definition file, new viruses, variants, and zero-day attacks may still slip through. This is exactly why you must not rely on antivirus software alone, and must also combine layered measures such as applying patches for the OS and applications, following a practice of not opening attachments in suspicious e-mail, and taking backups. So this statement is correct as well. About c: a bot is a malicious program that puts an infected PC into a state where it can be operated remotely from a command server the attacker has prepared. An attack network made up of many infected machines is called a botnet, and it is abused for sending large volumes of spam or as a stepping stone for DDoS attacks. A bot is also a kind of malware and thus a detection target of antivirus software, and products that can detect it do exist. Therefore all three statements a, b, and c are appropriate, and the correct answer is イ.
Incorrectウ
This option lists only b, and is wrong in excluding a and c. The viruses in a that infect via USB memory are in fact widespread, for instance in forms that abuse the auto-run function, and there are products that can detect them through removable-media scanning or real-time scanning. The bot in c is also a detection target. Judging that only b is appropriate underestimates the detection range of antivirus software and is not correct.
Incorrectエ
b and c are appropriate, but this option is wrong in excluding a. Infection routes for viruses are not limited to networks and e-mail; removable media such as USB memory have long been one of the major infection routes as well. Antivirus software can detect this kind of virus by scanning media when they are connected, or by real-time scanning when files are accessed, so a is an appropriate statement. A combination that drops a therefore cannot be the correct answer.
ここがポイント
- Limits of the virus definition file (pattern file) approach — antivirus software detects by comparing the inspected item against a definition file that records the characteristics of known viruses, and such a file can be created only after a new virus has been discovered and analyzed. Therefore, even with regular updating, new viruses, variants, and zero-day attacks may go undetected. The premise is that you do not depend on the software alone, but combine layered defenses such as applying patches, a practice of not opening suspicious attachments, and taking backups.
- The widening range of infection routes and malware types — infection routes for viruses include not only networks and e-mail but also removable media such as USB memory (for example by abusing the auto-run function). In addition, a bot is a malicious program that makes an infected PC remotely controllable from a command server; bots form a botnet that is abused for sending spam or as a stepping stone for DDoS attacks. These too are malware and therefore detection targets of antivirus software.
用語