問73
頻出度★★★
Web サービスを狙った攻撃に関する記述と攻撃の名称の適切な組合せはどれか。 a Web サービスが利用しているソフトウェアに脆弱性の存在が判明したとき，その修正プログラムが提供される前に，この脆弱性を突いて攻撃する。 b 複数のコンピュータから大量のパケットを一斉に送り付けることによって，Web サービスを正常に提供できなくさせる。 c 理論的にあり得るパスワードのパターンを順次試すことによって，正しいパスワードを見つけ，攻撃対象の Web サービスに侵入する。
令和7年度 ITパスポート試験 問73
テクノロジ系セキュリティ › 情報セキュリティ
This question's explanation and your answers so far.
解説
問 73
Incorrectア
It is wrong to label a as a “DDoS attack” and b as a “Zero-day attack.” a is the “Zero-day attack” that exploits a vulnerability before a patch is released, and b is the “DDoS attack” that disrupts the service with a large volume of packets; here a and b are swapped.
Incorrectイ
This option labels a as a “DDoS attack,” b as a “Brute-force attack,” and c as a “Zero-day attack,” so all three correspondences are wrong. The vulnerability-exploiting a is a Zero-day attack, the packet-flooding b is a DDoS attack, and the password-guessing c is a Brute-force attack.
- ウ
正解 Matching each description to an attack name: a exploits a vulnerability before a fix program (patch) is released, so it is a “Zero-day attack”; b sends a large volume of packets simultaneously from multiple computers to stop the Web service, so it is a “DDoS attack”; c tries the theoretically possible passwords one after another, so it is a “Brute-force attack.” The combination a: Zero-day attack, b: DDoS attack, c: Brute-force attack corresponds to choice ウ, and this is the correct answer.
Incorrectエ
The “Zero-day attack” for a is correct, but labeling b as a “Brute-force attack” and c as a “DDoS attack” is wrong. b disrupts the service with a large volume of packets, so it is a DDoS attack; c tries passwords one after another, so it is a Brute-force attack; here b and c are swapped.
ここがポイント
- Distinguish and memorize each definition: a Zero-day attack exploits an unpatched vulnerability before a fix program (patch) is released; a DDoS attack stops a service by sending a large volume of traffic simultaneously from many terminals; a Brute-force attack tries every conceivable password one by one.
- Be able to immediately identify the corresponding attack name from keywords such as “before a patch is released,” “a large volume of packets from multiple computers,” and “trying passwords one after another.”
用語