問83
頻出度★★★
情報システムに対する攻撃のうち, ある ID に対して所定の回数を超えてパスワードの入力を間違えたとき, 当該 ID の使用を停止させることが有効な防衛手段となるものはどれか。
平成28年度 秋期 ITパスポート試験 問83
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 83
Incorrectア
A DoS attack sends a large volume of traffic or processing requests to a server to halt or overload the service; it does not repeatedly try the password of a specific ID. Disabling an ID based on the number of failed inputs cannot prevent it, so this is wrong.
Incorrectイ
SQL injection slips a malicious SQL statement into an input field to illegitimately manipulate the database. It has nothing to do with repeatedly entering passwords, and is prevented by validating input values (sanitizing) and similar measures, so disabling the ID is not an effective countermeasure.
- ウ
正解 The correct answer is choice “ウ”, the brute-force attack. A brute-force attack enters every possible password one after another to try to guess the correct one, and its characteristic is that it repeatedly fails the input many times before it succeeds. Therefore, once the password for a certain ID is entered incorrectly more than a specified number of times, temporarily disabling that ID (account lock) stops the attacker from continuing the attempts and blocks them before they reach the correct password. Thus, “disabling an ID at an upper limit of failed inputs” is an effective defense measure.
Incorrectエ
Phishing uses fake websites or fake emails that closely resemble the real ones to deceive the users themselves into voluntarily entering their ID and password, thereby stealing them. Since it does not repeatedly fail on the legitimate login screen, disabling an ID based on the number of failed inputs cannot prevent it.
ここがポイント
- A brute-force attack tries passwords exhaustively; effective countermeasures include locking the account after a specified number of failures and using long, complex passwords.
- Memorize each attack name paired with its effective defense (account lock = brute-force countermeasure, input validation = SQL injection countermeasure, user education = phishing countermeasure, etc.).
用語