問70
頻出度★★★
情報セキュリティにおける脅威のうち, 脆弱性を是正するセキュリティパッチをソフトウェアに適用することが最も有効な対策になるものはどれか。
令和7年度 ITパスポート試験 問70
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 70
Incorrectア
A brute-force attack tries every possible password one after another to break through authentication. It targets the authentication mechanism, not a program defect, so the effective countermeasures are strengthening password length and complexity or enabling account lockout; a security patch cannot prevent it.
Incorrectイ
Social engineering is an attack that steals information by exploiting gaps in human psychology or behavior, such as impersonation or shoulder surfing, and has nothing to do with software vulnerabilities. The countermeasures are educating employees and strictly enforcing operational rules; a security patch cannot prevent it.
Incorrectウ
A password list attack uses a list of IDs and passwords leaked from somewhere and tries the same reused credentials on other services to log in illegitimately. It targets users' reuse of credentials, so the countermeasures are not reusing passwords and introducing multi-factor authentication; a security patch cannot prevent it.
- エ
正解 A security patch is meant to fix code-level defects (vulnerabilities) hidden in a software program. A buffer overflow is an attack that sends more data than the size of the memory area (buffer) the program has allocated, writes malicious code into the overflowing portion, and gets it executed; its cause is the implementation defect of the program itself. Therefore, applying a security patch that directly closes that defect is the most effective countermeasure, so エ is correct.
ここがポイント
- What a security patch can directly fix is an implementation defect (vulnerability) in the software, so it is most effective against attacks that exploit program flaws such as buffer overflow.
- Distinguish them: brute-force and password list attacks target credentials, and social engineering targets people; none of these are addressed by patches, but rather by operational management, stronger authentication, and education.
用語