問79
頻出度★★★
企業内ネットワークからも, 外部ネットワークからも論理的に隔離されたネットワーク領域であり, そこに設置されたサーバが外部から不正アクセスを受けたとしても, 企業内ネットワークには被害が及ばないようにするためのものはどれか。
平成25年度 秋期 ITパスポート試験 問79
This question's explanation and your answers so far.
解説
問 79
- ア
正解 The correct answer is “ア”, DMZ (DeMilitarized Zone). A DMZ is a third network area set up with a firewall so that it is logically separated both from the internal corporate LAN and from the external Internet. Servers that must accept access from outside — such as a public Web server, a mail server, or an externally published DNS server — are placed in this area. The firewall then controls traffic so that communication from the outside to the DMZ is permitted, while communication from the DMZ to the internal corporate network is blocked in principle. With this design, even if a server in the DMZ is compromised by unauthorized access, an attacker cannot use it as a stepping stone to break into the internal network, so the damage does not spread inside the company. DMZ is the only option that satisfies both conditions stated in the question: an area logically isolated from both sides, and no damage reaching the internal network even if a server there is breached.
Incorrectイ
DNS (Domain Name System) is the name resolution mechanism (and the servers that provide it) that converts between domain names such as www.example.co.jp and IP addresses. It is not an area that divides a network, and it has no isolation or access control function. Note that a public DNS server is often placed in a DMZ, but that makes it something placed inside a DMZ, not the DMZ itself.
Incorrectウ
DoS (Denial of Service) is the name of an attack technique in which a huge volume of traffic or invalid requests is sent to overload a server so that legitimate users cannot use the service. It is a term from the attacker side, not a protective mechanism, and it does not denote a network area, so it is incorrect.
Incorrectエ
SSL (Secure Sockets Layer, whose current successor is TLS) is a protocol that encrypts the communication path to prevent eavesdropping and tampering, and that verifies the legitimacy of a server with a certificate. What it protects is the content of the communication, not the division of a network into isolated areas. Moreover, even when SSL is used, if the server itself suffers unauthorized access it cannot stop the damage from spreading to the internal network, so it does not satisfy the condition in the question.
ここがポイント
- DMZ = a buffer area logically isolated by a firewall from both the internal corporate LAN and the external Internet. Public servers (Web, mail, external DNS, etc.) are placed there, and traffic from the DMZ toward the internal network is blocked, so that even if a public server is compromised the damage does not spread inside (it cannot be used as a stepping stone).
- Distinguish the confusing three-letter abbreviations: DMZ is a network area (a configuration), DNS is a name resolution service, DoS is a denial-of-service attack (an attack technique), and SSL/TLS is a communication encryption protocol. The key to solving such questions is to first identify which category is being asked about — an area, a service, an attack, or a protocol.
用語