問69
頻出度★★★
PC でWeb サイトを閲覧しただけで, PC にウイルスなどを感染させる攻撃はどれか。
平成31年度 春期 ITパスポート試験 問69
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 69
Incorrectア
A DoS attack sends a massive number of requests or malformed packets to overload a server or network, stopping or disrupting its service, thereby taking away the target's availability. It is not an attack that infects the browsing PC with a virus.
Incorrectイ
Social engineering exploits people's psychological weaknesses or carelessness, using tricks such as impersonation phone calls, shoulder surfing, or dumpster diving to extract information like IDs and passwords. It targets people rather than technical vulnerabilities, and does not infect a PC with a virus merely by browsing the web.
- ウ
正解 The correct answer is 'ウ Drive-by download'. A drive-by download is an attack in which the user merely views a tampered or malicious website and, without noticing (without making any click or download action), attackers exploit vulnerabilities in the browser or its plug-ins to automatically download and execute malware, infecting the PC. It matches exactly the condition in the question of 'being infected merely by browsing'.
Incorrectエ
A backdoor is a hidden entrance (an illegitimate intrusion route) planted in advance so that an intruder can re-enter without going through proper authentication. It is a mechanism that makes re-intrusion after infection easy, not the attack technique itself that infects via web browsing.
ここがポイント
- Drive-by download = an attack that, merely by browsing a malicious website, exploits vulnerabilities in the browser and the like to automatically download malware and infect the PC.
- Distinguishing confusingly similar terms: DoS = an attack that takes away availability; social engineering = a technique that targets people to extract information; backdoor = a hidden entrance used for re-intrusion.
用語