問90
頻出度★★★
セキュリティ対策として使用される WAF の説明として, 適切なものはどれか。
令和6年度 ITパスポート試験 問90
This question's explanation and your answers so far.
解説
問 90
- ア
正解 A WAF (Web Application Firewall), as its name suggests, is a firewall for “web applications”. It defends against attacks that exploit vulnerabilities in web application software (such as SQL injection and cross-site scripting) on sites like e-commerce sites, and it detects and blocks suspicious access patterns. Its defining feature is that it inspects the content of HTTP/HTTPS communication (requests). The description in choice “ア” matches this definition of a WAF exactly, so it is correct.
Incorrectイ
A mechanism that creates a secure communication channel like a dedicated line over public networks such as the internet is a description of a “VPN (Virtual Private Network)”, not a WAF.
Incorrectウ
A mechanism that identifies and monitors confidential data to prevent its loss or leakage to the outside is a description of “DLP (Data Loss Prevention)”, not a WAF.
Incorrectエ
A mechanism that uses a firewall to create a buffer zone between the internet and the internal corporate network is a description of a “DMZ (DeMilitarized Zone)”, not a WAF.
ここがポイント
- A WAF is a dedicated firewall that defends against and detects attacks exploiting web application vulnerabilities (such as SQL injection and XSS) at the HTTP communication level.
- A key point is distinguishing it from similar acronyms and mechanisms: do not confuse it with VPN (a secure communication channel over public networks), DLP (prevention of confidential data leakage), or DMZ (a buffer zone between internal and external networks).
用語