問92
頻出度★★★
外部と通信するメールサーバを DMZ に設置する理由として, 適切なものはどれか。
令和元年度 秋期 ITパスポート試験 問92
This question's explanation and your answers so far.
解説
問 92
Incorrectア
Preventing emails with confidential files attached from being sent to the outside is the job of DLP (data loss prevention), which inspects outbound content to stop leaks, or of email filtering; it has nothing to do with which network segment (the DMZ or the internal network) the server is placed in.
Incorrectイ
Encrypting email sent to an external business partner is achieved through encryption technologies such as TLS or S/MIME; email is not automatically encrypted merely because the mail server is placed in the DMZ. This is not a reason for placing it in the DMZ.
Incorrectウ
Preventing the email addresses of mailing list members from leaking to the outside is a matter of the sending method, such as putting recipients in BCC, or of how the list is operated and configured; it is unrelated to placing the server in the DMZ.
- エ
正解 The DMZ (demilitarized zone) is an intermediate segment placed between the external network (the internet) and the internal LAN, sandwiched by firewalls. A mail server that exchanges email directly with the outside is constantly exposed to attacks from the internet and risks being taken over. If it were placed on the internal LAN, the moment it is taken over the attacker would gain a foothold into the internal company network. By isolating the mail server in the DMZ instead, even if the server is compromised, the inner firewall can stop attackers from using it as a stepping stone (a relay point) to intrude into the internal company network. Therefore, choice エ, “to prevent the mail server from being used as a stepping stone to intrude into the internal company network from the outside”, is the appropriate reason for placing it in the DMZ.
ここがポイント
- The DMZ is a mechanism that isolates servers which must be exposed to the outside (mail, Web, DNS, etc.) into an intermediate segment sandwiched by inner and outer firewalls. Its purpose is to prevent such a server, even if compromised, from being used as a stepping stone into the internal company network.
- Do not confuse the question of “which network segment to place the server in (placement and isolation)” with “functions achieved by other measures” such as encryption, DLP, or list operation.
用語