問54
頻出度★★★
セキュリティに問題があるPCを社内ネットワークなどに接続させないことを目的とした仕組みであり, 外出先で使用したPCを会社に持ち帰った際に, ウイルスに感染していないことなどを確認するために利用するものはどれか。
平成26年度 秋期 ITパスポート試験 問54
This question's explanation and your answers so far.
解説
問 54
Incorrectア
A DMZ (demilitarized zone) is an intermediate network area placed between the Internet and the internal corporate network, where servers that must be exposed to the outside, such as public web servers and mail servers, are located. It is a network configuration designed so that even if such a public server is compromised, the damage is unlikely to spread to the internal network. It is not a mechanism that inspects a PC before connection and decides whether it passes.
Incorrectイ
An IDS (intrusion detection system) monitors the communications and logs flowing through networks and servers, detects signs of unauthorized access or attacks, and notifies the administrator. Its role is only to detect suspicious traffic that has already occurred and report it (blocking it is the job of an IPS). It does not inspect in advance the anti-virus status or patch status of a PC that is about to connect and decide whether the connection is allowed.
- ウ
正解 The correct answer is ウ, the quarantine network. A quarantine network is a mechanism in which a PC that is about to connect to the internal LAN is not connected directly to the normal network; instead it is first connected to an isolated network used only for inspection (a quarantine segment), where its security condition is checked. The checks cover items such as whether anti-virus software is installed and its definition file is up to date, whether security fixes (patches) for the OS and applications have been applied, and whether the PC is infected with a virus. Only PCs that pass the inspection are allowed to connect to the internal network; a PC that fails stays isolated and is directed to a remediation server so that its pattern files can be updated and patches applied. This matches exactly the uses stated in the question: preventing PCs with security problems from connecting to the internal network, and checking whether a PC used outside the company is infected with a virus when it is brought back. It is easier to remember if you think of it as the quarantine inspection done at airports and similar places to stop infectious diseases from being carried in.
Incorrectエ
A firewall permits or blocks communication at a network boundary based on conditions such as IP addresses and port numbers, and is mainly used to prevent unauthorized traffic from entering from the outside. What it controls is the communication, not the health of a device, so it cannot be used to check whether a PC brought into the company is infected with a virus and to allow the connection on that basis.
ここがポイント
- A quarantine network inspects a PC in an isolated segment before it connects to the internal LAN (whether anti-virus software is installed and its definition file is current, whether security patches have been applied, and whether it is infected) and lets only PCs that pass connect. It is a typical countermeasure for when a PC taken outside is brought back.
- A DMZ and a firewall are countermeasures that control communication at the network boundary, and an IDS is a countermeasure that detects signs of wrongdoing and gives notice; the purpose of all of them differs from that of a quarantine network, which inspects the health of the device itself.
用語