IPA IP 2025 Question 70
A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問70, translated into English. ITPEC is based on the same exams.
Among the threats in information security, which of the following is the one for which applying a security patch that corrects a vulnerability to software is the most effective countermeasure?
Explanation
Buffer overflow — the attack exploits a bug in the software itself, so fixing the software with a patch removes it.
In a buffer overflow attack, the attacker sends more data than a program's buffer can hold. If the program does not check the length, the excess overwrites the memory next to the buffer, and the attacker can crash the program or make it run code of the attacker's choosing. The weakness is a defect in the program, a vulnerability, so the most effective countermeasure is to apply the security patch that corrects it.
Answer (d)
Why not others:
- •(a) — a brute force attack tries every combination of characters for a password; it is countered by long, complex passwords and by locking an account after repeated failures, not by patching
- •(b) — social engineering exploits people's carelessness or trust (pretending to be staff on the phone, looking over a shoulder); it is countered by education and rules
- •(c) — a password list attack uses ID and password pairs leaked from another site; it is countered by not reusing passwords and by multi-factor authentication
Key rule: Attacks on software defects (buffer overflow and other vulnerabilities) are fixed by patches; attacks on passwords or people need password policies, lockouts and education.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.