問68
頻出度★★★
ファイアウォール機能付きルータとハブを用いて，PC3台とインターネット対応テレビをインターネットに接続したい。全ての機器に対して，ルータのファイアウォール機能が生かせる配線として適切なものはどれか。ここで，図中の“FW”はファイアウォール機能を示す。
平成25年度 春期 ITパスポート試験 問68
This question's explanation and your answers so far.
解説
問 68
- ア
正解 The firewall (FW) sits inside the router, at the boundary between the LAN side and the WAN side, and it can inspect only the traffic that passes through that boundary. In other words, any device you want to protect must be connected inside the FW, that is, on the router’s LAN side. In the wiring of choice ア, the three PCs are gathered on a hub, that hub is connected to a LAN-side port of the router, and the Internet-capable TV is likewise connected directly to a LAN-side port of the router. Only the WAN side of the router is connected to the Internet. Therefore, whenever any of the three PCs or the TV communicates with the Internet, the traffic necessarily passes through the FW inside the router, so the firewall function works for all of the devices. The hub is used only to add more connection ports on the LAN side, so its position inside the FW does not change.
Incorrectイ
The TV hangs off a hub attached to the router’s WAN side, and on top of that the Internet line loops around the upper part of the figure and enters a LAN-side port of the router. Because the LAN-side and WAN-side connections are reversed, the three PCs lined up on the LAN side end up on the same side as the Internet, so their traffic does not pass through the FW. The TV is outside the FW as well, so in the end no device is protected.
Incorrectウ
Only two PCs are connected to the router’s LAN side, while the remaining PC, the TV, and the Internet all share a hub that is connected to the WAN side. A hub merely lets traffic pass straight through and has no filtering function, so this PC and the TV are in the same state as being connected directly to the Internet and get no protection from the FW. This does not satisfy the condition “for all devices.”
Incorrectエ
The three PCs are on the router’s LAN side, but the Internet line comes in through a hub into a LAN-side port of the router, and the TV is connected directly to the router’s WAN side. As with choice イ, the roles of the LAN side and the WAN side are swapped, so the PCs sit on the same segment as the Internet and their traffic does not pass through the FW. The TV is outside the FW as well, so the condition is not satisfied.
ここがポイント
- A firewall is placed at the boundary between the internal network (the router’s LAN side) and the external network (the WAN side, i.e. the Internet), and it can inspect and block only the traffic that crosses that boundary. Every device you want to protect must be connected on the LAN side, without exception.
- A hub (switching hub) is merely a device that adds more ports to extend the same network; it has no filtering function. Using a hub on the LAN side does not change the protected range, but if a device is connected to a hub placed on the WAN side, that device ends up outside the FW.
用語