問91
頻出度★★★
ソーシャルエンジニアリングに該当する行為の例はどれか。
令和4年度 ITパスポート試験 問91
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 91
Incorrectア
Mechanically trying every possible combination of characters in a brute-force manner to find out a password is a brute-force attack, a technical password-cracking method, not social engineering that targets human psychology.
- イ
正解 The correct answer is イ. Social engineering is a general term for methods of obtaining confidential information not by exploiting a computer’s technical vulnerabilities, but by exploiting weaknesses on the human side, such as a person’s psychological lapses or carelessness. Choice イ, “obtaining a password by peeking over someone’s shoulder (shoulder surfing) and using it to impersonate another person and illegally use the system,” is a typical example of social engineering that steals information by observing human behavior rather than using technology, so this is the one that applies.
Incorrectウ
Sending a large volume of requests to a target server to put it into an overloaded state and disrupt the provision of the service is a DoS (denial-of-service) attack, a method that technically attacks the network and system, and does not constitute social engineering.
Incorrectエ
Entering data longer than the memory area allocated by a program to cause a buffer overflow and illegally execute the program is a buffer overflow attack, a technical attack that exploits a program’s vulnerability, not social engineering that exploits human lapses.
ここがポイント
- Social engineering is a technique that obtains information not by technical means but by exploiting lapses in human psychology and behavior (such as peeking, impersonation, and deception over the phone).
- Brute force, DoS, and buffer overflow are all methods that technically attack systems or programs, and should be distinguished from social engineering.
用語