問92
頻出度★★★
従業員が使用する PC がランサムウェアに感染した場合の損害を軽減する対策例として, 適切なものはどれか。
令和7年度 ITパスポート試験 問92
This question's explanation and your answers so far.
解説
問 92
- ア
正解 Ransomware is malware that encrypts data on a PC or file server and demands money in exchange for decryption. After infection, the most effective way to “reduce the damage (ensure recoverability)” is to keep a separate, intact backup that the ransomware cannot rewrite. Choice ア regularly takes a backup of the file server's HDD and then stores the backup medium disconnected from the network. This way, even if the infection spreads over the network, the backup itself is not encrypted, so data can be restored even after damage occurs, and operations can resume without paying the ransom. It is therefore an appropriate example of a measure to reduce the damage.
Incorrectイ
Multi-factor authentication strengthens identity verification and prevents unauthorized login (impersonation). It is effective at deterring unauthorized access when IDs/passwords are leaked, but it has no effect on reducing the damage itself caused by data encryption from ransomware on an already-infected PC.
Incorrectウ
Encrypting the PC's HDD is a measure to prevent information leakage where a third party reads the data when the device is stolen or lost. Because ransomware overwrites and re-encrypts data that the user can already decrypt and use, the damage from infection (the data becoming unusable) cannot be prevented even if the HDD is encrypted.
Incorrectエ
Locking the ID after the password is entered incorrectly multiple times is an account-lockout measure that prevents unauthorized logins such as brute-force attacks. It has nothing to do with reducing the data damage after a ransomware infection.
ここがポイント
- The key to ransomware defense is to regularly take “offline backups disconnected from the network”, ensuring a recovery means that will not be encrypted even if the infection spreads.
- Distinguish between “reducing” the damage (recovery) and “preventing” the damage (stronger authentication, account lockout, encryption). Multi-factor authentication, account lockout, and HDD encryption are measures against unauthorized access or information leakage, not measures that reduce the ransomware encryption damage itself.
用語