問54
頻出度★★★
ファイルサーバの運用管理に関する記述 a～d のうち, セキュリティ対策として有効なものだけを全て挙げたものはどれか。 a アクセスする利用者のパスワードを複雑かつ十分な長さに設定する。 b 許可された IP アドレスの PC だけからアクセスできるように設定する。 c ゲストユーザにもサーバへアクセスできる権限を与える。 d サーバのアクセスログを取得し, 定期的に監査する。
平成26年度 春期 ITパスポート試験 問54
This question's explanation and your answers so far.
解説
問 54
- ア
正解 The correct answer is ア“a, b, d”. To judge whether a practice is effective as a security measure for a file server, ask whether it prevents unauthorized access from happening (prevention) or lets you detect and trace unauthorized activity after the fact (detection). Item a sets user passwords to be complex and sufficiently long, which makes them hard to guess by dictionary attacks or brute-force attacks, so it is effective. Item b limits the connection source to PCs with permitted IP addresses; even if a user ID and password leak, no one can connect from outside the company or from an unapproved device, so it is effective as access control. Item d collects access logs and audits them periodically; by itself it does not stop an intrusion, but it lets you discover unauthorized access or out-of-scope operations afterwards and trace the cause so it does not happen again, so it is effective as a detective control, and the awareness that logs will be audited also discourages misuse. Item c alone grants access rights even to guest users (users who are close to unspecified or anonymous) on a server whose access should be restricted; this violates the principle of least privilege, which says to give only the necessary rights to the people who need them, and it weakens security. Therefore the effective items are the three a, b and d, and ア, which lists exactly those and nothing more, is the correct answer.
Incorrectイ
“a, d” does list only effective items, but it omits b, which is effective as well. Item b, configuring access so that it is allowed only from PCs with permitted IP addresses, is a typical security measure that limits the connecting devices and controls access, so there is no reason to exclude it. The question asks for the option that lists all of the effective items, so イ, which is incomplete, is not correct.
Incorrectウ
“b, c” does include b, which is an effective measure, but it wrongly counts c, which weakens security, as effective. Granting access rights to the server even to guest users needlessly widens the range of users who can access it; far from being a countermeasure, it increases the threat. In addition, the effective items a and d are missing.
Incorrectエ
Both items in “b, d” are indeed effective, but a, setting the password of accessing users to be complex and sufficiently long, is missing. Strengthening passwords is a basic and effective measure that makes user authentication hard to break, so it cannot be left out of the effective items. Because this option does not satisfy the condition of listing all effective items, it is wrong.
ここがポイント
- Judge the effectiveness of a security measure from two sides: prevention and detection. Strengthening passwords (stronger authentication) and restricting access by source IP address (access control) are preventive measures that stop unauthorized access before it happens, while collecting access logs and auditing them periodically is a detective measure that finds and traces misuse after the fact. Both kinds are effective.
- Access rights should follow the principle of least privilege: give only the scope that is necessary for the job, and only to the users who need it. Extending access rights to unspecified users such as guest users is not a countermeasure but an increase in risk. Also note that in questions of the form “list all of the effective items among a to d”, you must pick the option that includes every effective item and nothing else.
用語