問73
頻出度★★★
インターネット経由で行うペネトレーションテストで見つけられる脆弱性の例として, 適切なものはどれか。
平成28年度 秋期 ITパスポート試験 問73
This question's explanation and your answers so far.
解説
問 73
- ア
正解 Penetration testing is an inspection method that actually attempts intrusion using an attacker's techniques in order to identify a system's vulnerabilities. This question adds the condition “conducted via the Internet,” so only the parts reachable from the external-network side become the inspection target. Option ア, “an unauthorized intrusion entry point from an external network into a public server,” is exactly about checking whether there is any hole that lets an attacker attack and break into the public server from the outside, and it is a representative example of a vulnerability that can be detected by penetration testing conducted via the Internet. Therefore ア is correct.
Incorrectイ
The taking out of confidential information via a recording medium (such as a USB flash drive) is an act in which an insider uses a physical medium to carry information outside; it is an issue of operational and physical management. It cannot be detected by an intrusion test conducted over the network, so it is incorrect.
Incorrectウ
A virus infection of a PC attempting to connect to the internal company network is an issue of a terminal inside the organization, and it is outside the scope of an intrusion test from the Internet (external) side. It is a matter handled by internal malware protection and endpoint management, so it is incorrect.
Incorrectエ
An unauthorized entry route into a security-protected room is a vulnerability in physical security, namely entry/exit (access) management. It cannot be found by a technical intrusion test conducted over the network, so it is incorrect.
ここがポイント
- Penetration testing (intrusion testing) is an inspection method that actually attempts intrusion from an attacker's viewpoint to confirm whether the system has any exploitable vulnerabilities.
- When conducted “via the Internet,” what can be detected is limited to vulnerabilities reachable from the external network; physical/internal issues such as internal terminals, recording media, and room entry/exit are out of scope.
用語