問87
頻出度★★★
情報セキュリティ上の脅威であるゼロデイ攻撃の手口を説明したものはどれか。
平成30年度 春期 ITパスポート試験 問87
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 87
Incorrectア
This description involves a time limit — “shutting down the system within 24 hours after the attack begins” — but the “day” in zero-day refers to the number of grace days until a countermeasure is released, not to a 24-hour attack speed. It has nothing to do with the definition of a zero-day attack, so it is wrong.
Incorrectイ
“Making a virus with no incubation period trigger symptoms immediately after infection” concerns the timing of a virus’s onset, which is a different concept from a zero-day attack. It mistakes “zero-day” for “zero incubation period.” The essence of zero-day is that the countermeasure for the vulnerability has not yet been released; whether a virus has an incubation period is irrelevant.
- ウ
正解 A zero-day attack is an attack that exploits a software vulnerability in the stage “before” a countermeasure for that vulnerability (a fix or a security patch) is released, after the vulnerability has been discovered. Because no countermeasure is yet available, the defending side is unprotected and damage tends to spread easily — that is its defining feature. Choice ウ, “it exploits a software vulnerability before a countermeasure for the vulnerability is released,” is exactly this definition, and is therefore correct.
Incorrectエ
“Obtaining confidential information from others through conversational tricks or eavesdropping” describes a social engineering technique that exploits gaps in human psychology and behavior, which differs from a zero-day attack that exploits a software vulnerability. The target of the attack (people vs. a vulnerability) is different, so it is wrong.
ここがポイント
- Zero-day attack = an attack that exploits a vulnerability before a fix (patch) or countermeasure for it is released. Its essence is striking at a point in time when no defensive measure exists yet.
- Note that “zero-day” derives from the grace period until a countermeasure is released being zero days; it does not refer to the time an attack takes or a virus’s incubation period.
用語