問89
頻出度★★★
企業の従業員になりすまして ID やパスワードを聞き出したり, くずかごから機密情報を入手したりするなど, 技術的手法を用いない攻撃はどれか。
令和5年度 ITパスポート試験 問89
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 89
Incorrectア
A zero-day attack exploits the defenseless window between when a software vulnerability is discovered and when a fix (patch) is released. It is an attack that uses a sophisticated technical method of exploiting an unknown vulnerability, which contradicts the question’s condition of “not using technical methods.”
- イ
正解 The correct answer is “イ Social engineering.” Social engineering is a general term for techniques that steal confidential information by exploiting people’s psychological gaps or behavioral mistakes, rather than the technical vulnerabilities of computers or networks. The question’s examples — “impersonating an employee to extract IDs or passwords” (impersonation, or fraud via phone or email) and “obtaining confidential information from a wastebasket” (trashing/scavenging) — use no technology such as programs or code-breaking at all, and instead target people or discarded paper documents. This is exactly a typical example of social engineering, and it matches the question’s condition of “an attack that does not use technical methods.”
Incorrectウ
Social media refers to internet services such as SNS where people post and share information; it is not an attack method at all. Although it is confusing because the name also starts with “social,” it is not the name of an attack, so it is incorrect.
Incorrectエ
A Trojan horse is malware (a malicious program) that disguises itself as harmless software to intrude into a computer and carries out unauthorized actions in the background. It is a technical attack that uses a program, not a non-technical method of deceiving people to extract information, so it is incorrect.
ここがポイント
- Social engineering = a method of obtaining confidential information by exploiting people’s psychological or behavioral gaps rather than relying on technology. Typical examples are extracting information through impersonation, peeping (shoulder hacking), and rummaging through trash (trashing).
- Distinguish them by contrast: zero-day attacks and Trojan horses are attacks that use technology (exploiting vulnerabilities, malware), whereas social media is not an attack at all.
用語