問100
頻出度★★★
社内に設置された無線 LAN ネットワークに接続している業務用の PC で, インターネット上のある Web サイトを閲覧した直後, Web ブラウザが突然終了したり, 見知らぬファイルが作成されたりするなど, マルウェアに感染した可能性が考えられる事象が発生した。この PC の利用者が最初に取るべき行動として適切なものはどれか。
令和4年度 ITパスポート試験 問100
This question's explanation and your answers so far.
解説
問 100
Incorrectア
Reinstalling the web browser neither investigates the cause nor prevents the damage from spreading. The infection is not necessarily limited to damage of the browser itself; it may lurk in other files or in the system, so it is inappropriate as the very first action to take.
Incorrectイ
Updating the malware definition files is useful as preparation for removal, but that is a step to be done after isolating the PC and stopping the spread of damage. Since the infection can still spread while updating and scanning with the PC still connected to the network, this is wrong in order as the first action.
- ウ
正解 When a malware infection is suspected, the first action the user should take is to “stop any further spread of the damage.” If the infected PC is left connected to the network, the malware could spread the infection to other devices within the company, communicate with an outside attacker to steal information, or let the PC be operated remotely. Therefore, disconnecting from the wireless LAN communication and isolating the PC from the network breaks the chain of spreading damage and puts the PC in a state where the subsequent investigation and removal can be carried out safely. This is why choice ウ is correct.
Incorrectエ
Changing the encryption method of the wireless communication is a countermeasure against eavesdropping on communications; it does not address the malware infection that is already occurring inside the PC. It contributes neither to preventing the spread of the infection nor to its removal, so it is inappropriate.
ここがポイント
- When a malware infection is suspected, the first response is to “isolate the PC from the network and stop the spread of damage” (the first step of incident response = containment).
- Recovery and hardening measures such as reinstalling, updating definition files, or changing the encryption method are steps to be carried out only after isolating the PC and ensuring safety.
用語