問56
頻出度★★★
ランサムウェアによる損害を受けてしまった場合を想定して, その損害を軽減するための対策例として, 適切なものはどれか。
令和4年度 ITパスポート試験 問56
This question's explanation and your answers so far.
解説
問 56
- ア
正解 Ransomware is malware that encrypts files on a PC without permission and demands a ransom in exchange for decryption. Once you are hit, it is very hard to restore the encrypted files themselves, so the most reliable way to mitigate the damage is to restore from a backup that was saved separately in advance. As in option ア, if you regularly back up important files to an external storage device that can be detached from the PC, you can restore from that medium even after being hit and keep the loss to a minimum. A detachable medium is chosen because, if it stays connected all the time, the backup itself may be encrypted at the moment of infection; keeping it disconnected prevents the backup from being caught up in the damage. Therefore, ア is appropriate.
Incorrectイ
Using a different ID and password for each Web service is a countermeasure against a password list attack, in which an attacker reuses credentials leaked from one service to illicitly log in to other services. It is a measure to prevent account takeover and has nothing to do with mitigating (recovering from) ransomware damage.
Incorrectウ
Scanning all files on the PC with anti-malware software is a preventive/detective measure meant to stop or spot the infection itself before it happens. The question assumes a case where damage has already occurred and asks about after-the-fact damage mitigation, and such a scan cannot restore files that have already been encrypted.
Incorrectエ
Encrypting the communication content with WPA2 when using a wireless LAN is a measure to prevent eavesdropping on communications. It is unrelated to recovering from the file-encryption damage caused by ransomware and does not help mitigate the damage.
ここがポイント
- Ransomware is malware that encrypts files and demands a ransom. The key to mitigating loss after being hit is restoring from a backup.
- If a backup stays connected all the time, it gets encrypted together with everything else at the moment of infection, so saving it on a detachable medium and keeping it disconnected is effective (distinguish preventive/detective measures from after-the-fact recovery measures).
用語