問76
頻出度★★★
セキュリティ対策の目的①～④のうち, 適切なアクセス権を設定することによって効果があるものだけを全て挙げたものはどれか。 ① DoS攻撃から守る。 ② 情報漏えいを防ぐ。 ③ ショルダハッキングを防ぐ。 ④ 不正利用者による改ざんを防ぐ。
平成26年度 春期 ITパスポート試験 問76
This question's explanation and your answers so far.
解説
問 76
Incorrectア
It is wrong because it includes ①. A DoS attack (denial-of-service attack) overloads servers or networks by sending huge numbers of requests or oversized data, making the service unusable for legitimate users, and it targets the entrance of a public service that anyone can connect to. Access rights are a mechanism that decides what an authenticated user may do with a resource, so they cannot hold down the traffic volume itself, which arrives before permissions are judged. The countermeasures are firewalls, IPS, traffic rate limiting, load balancing, and so on. Also, the correct ④ is missing, so it does not list all the items that are effective.
Incorrectイ
Both ① and ③ are wrong, and this choice includes none of the correct items ② and ④. ① is a DoS attack, which as described above cannot be prevented by access rights, and ③ shoulder hacking is a physical, human act of peeking from behind at a password being typed in or at what is displayed on the screen, so information is stolen regardless of the system's permission settings. This choice does not satisfy the question's condition of listing all and only the effective items.
- ウ
正解 The correct answer is ウ: “② and ④.” An access right (access control) is a mechanism that decides, for each user or group, whether operations such as read (view), write (update), and execute are permitted on resources such as files, databases, and system functions. Therefore it is effective only for objectives that can be stopped by granting or withholding permission. ② Preventing information leakage: if read permission on confidential files is limited to only the staff who need it for their work, users without permission cannot view the contents at all, which is the typical case where setting access rights takes effect directly. ④ Preventing tampering by unauthorized users can also be handled this way, because data cannot be rewritten if write, update, and delete permissions are not granted. The read-only setting, which lets many users only view the data while allowing only a limited number of staff to update it, is exactly this idea put into practice. Conversely, ① and ③ both occur outside the logical permission settings called access rights, so they are not effective. Hence the combination that lists all and only the effective items is ② and ④.
Incorrectエ
④ is correct, but it is wrong to include ③. The countermeasures against shoulder hacking (shoulder surfing) are physical and operational ones such as attaching a privacy filter, adjusting the direction of the screen and the seating layout, locking the screen when leaving the desk, and checking the surroundings while typing; they cannot be handled by setting access rights. In addition, the correct item ② is missing, so in any case this choice does not list all of the effective items.
ここがポイント
- An access right (access control) is a logical mechanism that specifies, for each user or group, whether reading, writing, and executing a resource are permitted. Restricting reading works directly to prevent information leakage, and restricting writing and updating works directly to prevent tampering.
- The key point is being able to tell apart the threats that access rights cannot stop. DoS attacks (attacks on availability) are defended against with communication-level measures such as firewalls and load balancing, while shoulder hacking is defended against with physical and human measures such as privacy filters and screen locking. It helps to organize it in memory like this: among the three elements of information security, access rights mainly protect confidentiality and integrity, while availability and human or physical threats need separate measures.
用語