問77
頻出度★★★
マルウェアの説明として, 適切なものはどれか。
平成25年度 秋期 ITパスポート試験 問77
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 77
Incorrectア
“A mechanism for detecting unauthorized intrusion from the Internet into an internal network” describes an IDS (Intrusion Detection System). This is a defensive mechanism that protects an organization from threats such as malware; it is not malicious software itself, so this choice is wrong.
- イ
正解 Malware is a word formed by combining “malicious” and “software”, and it is a general term for all software created with the purpose of harming users or computers. Computer viruses, worms, Trojan horses, spyware, ransomware, and so on are all types of malware. Therefore イ, which states “A general term for malicious software, including computer viruses, worms, and the like”, is the correct answer. The key point is that malware does not refer to one specific kind of attack program; it is a broader, higher-level concept that groups together all malicious software.
Incorrectウ
“A general term for software that performs file sharing between computers over a network” describes P2P (peer-to-peer) file-sharing software. Although file-sharing software can become a route for malware infection or information leakage, the software itself is not created for malicious purposes, so it is a different thing from the definition of malware.
Incorrectエ
“The act of stealing internal company information through conversational techniques, eavesdropping, and the like” describes social engineering. It is an “act” that exploits human psychology or carelessness, not software, so it is wrong as a description of malware.
ここがポイント
- Malware = short for malicious software; it is the higher-level concept of “a general term for malicious software” that covers viruses, worms, Trojan horses, spyware, ransomware, and more.
- Distinguish the confusing related terms: an IDS is a defensive mechanism that detects unauthorized intrusion, P2P file-sharing software is legitimate software, and social engineering is an “act” that targets people rather than software.
用語