問65
頻出度★★★
人の心理的な隙や不注意に付け込んで機密情報などを不正に入手する手法はどれか。
平成29年度 秋期 ITパスポート試験 問65
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 65
Incorrectア
A DoS attack sends a large volume of packets or requests to a server to halt or disrupt its service; its target is a computer or network. It is not a method that exploits human psychology, so it is incorrect.
Incorrectイ
SQL injection is a technical attack that injects malicious SQL statements into input fields of a web application to manipulate the database illicitly and steal information. It exploits vulnerabilities in the program, not people's psychological vulnerabilities, so it is incorrect.
- ウ
正解 The correct answer is ウ, social engineering. This is not a technical attack; it is a method of illegally obtaining confidential information by exploiting people's psychological vulnerabilities or carelessness. Typical examples include impersonating a system administrator to extract a password over the phone, peeking at a screen or keystrokes over someone's shoulder (shoulder hacking), and rummaging through documents thrown in the trash to gather information (trashing). The wording in the question, exploiting people's psychological vulnerabilities or carelessness, is exactly the definition of social engineering itself, so ウ is correct.
Incorrectエ
A buffer overflow is a technical attack that sends more data than the memory area (buffer) allocated by a program, writing malicious code into the overflowing portion and getting it executed. It exploits software vulnerabilities, not people's carelessness, so it is incorrect.
ここがポイント
- Social engineering is not a technical means but a method of obtaining confidential information by exploiting the psychological vulnerabilities or carelessness of people. Representative examples are impersonation phone calls, shoulder hacking (peeking from behind), and trashing (rummaging through garbage).
- The other choices (DoS attack, SQL injection, buffer overflow) are all technical attacks that exploit vulnerabilities in computers or programs; the key point is being able to distinguish them from methods that exploit human psychology.
用語