問55
頻出度★★★
企業のネットワークにおける DMZ の設置目的として, 最も適切なものはどれか。
平成23年度 特別試験 ITパスポート試験 問55
This question's explanation and your answers so far.
解説
問 55
- ア
正解 The correct answer is ア. A DMZ (DeMilitarized Zone) is a network segment that serves as a buffer zone, separated by a firewall from both the Internet and the internal company network (the internal LAN). In a typical configuration, the firewall divides three areas — the Internet, the DMZ, and the internal LAN — and only the servers that must be made public for business reasons, such as Web servers, mail servers, DNS servers, and public FTP servers, are placed in the DMZ. Public servers are accessed by an unspecified large number of people, so they carry the highest risk of being broken into or taken over through a vulnerability. If they were placed directly on the internal LAN, then just one server being taken over would let an attacker use it as a stepping stone to reach the company's confidential information and file servers. For this reason the public servers are isolated in a separate segment called the DMZ, and the firewall filters traffic by direction: access from the Internet to the public services in the DMZ is allowed, access from the internal LAN to the DMZ is allowed, and communication from the DMZ to the internal LAN is forbidden in principle. With this arrangement, even if a server in the DMZ is compromised, traffic going from there into the internal LAN is blocked by the firewall, and the damage can be contained inside the DMZ. In other words, the purpose of setting up a DMZ is to isolate servers that are made public to the outside from the internal company network and to make the defensive boundary double-layered, so ア, which states this, is the most appropriate.
Incorrectイ
This describes NAT (Network Address Translation) or NAPT (IP masquerade), not the purpose of setting up a DMZ. NAT/NAPT is a function provided by routers and firewalls that converts between the private IP addresses used inside the company and the global IP addresses used on the Internet. Its purpose is to save the limited number of global IP addresses by sharing them among multiple devices, and to keep the addresses of internal devices from being directly visible from outside. NAT is often used together with a DMZ, but that is a mechanism for converting how addresses are written, which is a different concept from how the network is divided — that is, which segment the public servers are placed in (the purpose of a DMZ).
Incorrectウ
This describes antivirus software, or an antivirus gateway that inspects the data passing through a mail gateway or a proxy server — not the purpose of setting up a DMZ. A DMZ is purely a division in the network configuration that decides where servers are placed and which direction of traffic is allowed; it does not itself have a function that scans the content of communications to detect and remove viruses. A gateway for virus protection may indeed be placed in the DMZ, but that is only the role of one server located there, and it has to be understood separately from the purpose of the DMZ itself.
Incorrectエ
This describes a VPN (Virtual Private Network), and in particular an Internet VPN that uses Internet lines — not the purpose of setting up a DMZ. A VPN encrypts the communication path and builds a tunnel, thereby creating over the Internet, which is a public network, a virtual closed communication path that behaves as if the sites were connected by a dedicated line; it is used for connecting business sites and for remote access during telework. Its purpose is to ensure the confidentiality and integrity of communications, not to isolate public servers from the internal company network. Take care not to confuse these two measures, which have different aims: protecting a communication path by encryption, and isolating servers by dividing segments.
ここがポイント
- Definition and role of a DMZ — A DMZ is a buffer segment carved out by a firewall so that it connects directly to neither the Internet nor the internal company LAN, and it is where servers that have to be made public, such as Web servers, mail servers, and DNS servers, are placed. The basic filtering pattern is: from the Internet to the DMZ, allow only the necessary services; from the internal LAN to the DMZ, allow access; from the DMZ to the internal LAN, forbid in principle. The purpose of setting one up is to contain the damage so that it does not spread to the internal LAN even if a public server is compromised.
- Telling confusingly similar technologies apart — A DMZ (isolating servers by dividing segments), NAT/NAPT (saving addresses and hiding the internal network by converting between private and global IP addresses), an antivirus gateway (inspecting the data that passes through and removing viruses), and a VPN (a virtual dedicated line made with an encrypted tunnel) are all network security terms, but each has a different purpose. When you are asked about a purpose, it helps to remember each one by what it protects from what, and where in the network the mechanism works.
用語