問77
頻出度★★★
ネットワークやホストを監視することによって, 不正アクセスや不審な通信を発見し, 報告する仕組みはどれか。
令和7年度 ITパスポート試験 問77
This question's explanation and your answers so far.
解説
問 77
Incorrectア
A DMZ (demilitarized zone) is a buffer network area placed between the external network and the internal network, where public servers and the like are deployed so that the internal network is not directly exposed; it is a network configuration. It is not a mechanism that monitors and then detects and reports suspicious communications.
- イ
正解 The correct answer is choice イ, IDS. IDS (Intrusion Detection System) is a mechanism that continuously monitors the packets flowing across a network as well as the logs and behavior on hosts, and when it detects patterns of unauthorized access or suspicious communication, it warns (reports to) the administrator. This exactly matches the stem's description of “monitoring networks and hosts” and “detecting and reporting unauthorized access and suspicious communications.” Note that a mechanism that not only reports detected attacks but also automatically blocks them is called an IPS (Intrusion Prevention System).
Incorrectウ
Anti-passback is an entry/exit control method used to prevent a person with no entry record from exiting, and to prevent tailgating or repeated entry using a single IC card; it is a physical security mechanism. It does not monitor the communications of networks or hosts.
Incorrectエ
A bot is a malicious program (malware) that an attacker infects a victim with in order to control it remotely, and it is used as a stepping stone for sending spam or launching DDoS attacks. It is something on the attacker's side, not a defensive mechanism that detects and reports unauthorized activity.
ここがポイント
- An IDS (Intrusion Detection System) is a mechanism that monitors networks or hosts, detects unauthorized access and suspicious communications, and reports them to the administrator. Also grasp how it differs from an IPS, which goes as far as blocking.
- Distinguish the different roles of the security terms: DMZ (network configuration), anti-passback (physical entry/exit control), and bot (malware used for attacks).
用語