問68
頻出度★★★
企業のネットワークにおいて, DMZ (非武装地帯) ではなく, 企業内 LAN に設置すべきサーバはどれか。
平成30年度 春期 ITパスポート試験 問68
This question's explanation and your answers so far.
解説
問 68
Incorrectア
A mail server that receives email from outside the company is a public server that must accept SMTP connections from external mail servers, so it is conventionally placed in the DMZ. If it were put on the internal LAN, it could not receive mail directly from outside and thus could not fulfill its role.
Incorrectイ
A DNS server that registers the IP addresses of servers published to the outside (an external-facing DNS) is a public server that receives name-resolution queries from the internet, so it is placed in the DMZ. If it were hidden on the internal LAN, clients outside the company could no longer resolve the names of the public servers.
- ウ
正解 The DMZ (demilitarized zone) is a buffer segment, isolated from the internal LAN by a firewall, that holds public servers which must accept access from outside the company. The internal corporate LAN, by contrast, holds servers that are never exposed to the outside. The file server in option ウ, which stores confidential information kept secret within the company, not only has no need to be published externally but is an asset that must never be reachable from outside. If it were placed in the DMZ, it would sit close to the external network, raising the risk of information leakage if the system were breached. Therefore the server that should be placed on the internal LAN is ウ, which is correct.
Incorrectエ
A web server that publishes information to the outside is a public server premised on being accessed from the internet over HTTP/HTTPS, a typical example of a server placed in the DMZ. Since its purpose is external publication, it is not placed on the internal LAN.
ここがポイント
- The DMZ is a buffer segment where public servers that must be reachable from outside the company (public web, external-facing DNS, incoming mail, etc.) are placed, isolated from the internal LAN.
- Servers that handle confidential information — which need not be published externally and should instead be blocked from outside access (such as a file server holding company-confidential data) — are placed on the internal corporate LAN, not in the DMZ.
用語