問62
頻出度★★★
ペネトレーションテストの説明として, 適切なものはどれか。
平成26年度 秋期 ITパスポート試験 問62
This question's explanation and your answers so far.
解説
問 62
- ア
正解 The correct answer is ア. A penetration test is a test in which the tester uses the same techniques as an attacker to actually attack the target system and attempt to break in, and then uses the results to find and evaluate security weaknesses (vulnerabilities or misconfigurations). Unlike a paper-based check or a configuration review, its key feature is verifying in practice whether the system can really be broken into, which makes it possible to confirm empirically that a firewall or a public-facing server is defending as intended. Therefore ア, which states that it discovers security weaknesses by actually attacking the system and attempting to break in, is the appropriate description of this term.
Incorrectイ
Applying a higher-than-normal load to check whether the system still functions correctly describes a load test (stress test). It verifies performance and endurance, so its purpose differs from that of a penetration test, which looks for security weaknesses.
Incorrectウ
After modifying a program, checking whether the modification has caused unexpected effects on existing functions describes a regression test. It detects side effects of a change; it does not try to see whether the system can be broken into.
Incorrectエ
Having users actually use the system to check its ease of use describes a usability test. What it evaluates is operability and clarity; its purpose is not to find security vulnerabilities.
ここがポイント
- Penetration test = a security test that actually attempts to break in from an attacker's viewpoint, empirically uncovering the system's vulnerabilities and misconfigurations. It is carried out to confirm whether the defenses of firewalls and public-facing servers are effective.
- Distinguish types of testing by their purpose: load test = performance and endurance; regression test = whether a change caused side effects; usability test = ease of use; penetration test = security weaknesses.
用語