IPA IP 2025 Question 73

Topic: Security

A question IPA Japan published in 令和7年度 ITパスポート試験 公開問題 問73, translated into English. ITPEC is based on the same exams.

Which of the following is the appropriate combination of descriptions concerning attacks that target web services and the names of the attacks?

AWhen the existence of a vulnerability is found in software that a web service uses, the attacker exploits this vulnerability in an attack before a patch for it is provided.BBy sending a large number of packets from multiple computers all at once, the attacker makes the web service unable to be provided normally.CBy trying in turn the password patterns that are theoretically possible, the attacker finds the correct password and intrudes into the targeted web service.
OptionABC

Explanation

Zero-day, DDoS, brute force — item A exploits a vulnerability before its patch exists, item B floods the service from many computers, item C tries every password.

  • •Item A is a zero-day attack: it exploits a vulnerability in the gap between its discovery and the release of a patch, so applying updates cannot yet stop it
  • •Item B is a DDoS (Distributed Denial of Service) attack: many computers, often a botnet of infected PCs and IoT devices, send a flood of packets at once, so the service cannot respond to genuine users; coming from many sources, it is hard to block by address
  • •Item C is a brute force attack: it tries every possible combination of characters in turn until the correct password is found; long passwords with many kinds of characters, and locking an account after repeated failures, are the countermeasures

Answer (c)

Why not others:

  • •(a) — swaps A and B: exploiting a vulnerability before the fix is zero-day, and the flood from many computers is DDoS
  • •(b) — none of the three is right: A is zero-day, B is DDoS and C is brute force
  • •(d) — A is right, but B and C are swapped: the packet flood is DDoS, and trying the password patterns is brute force

Key rule: Zero-day = an attack before the patch; DDoS = a flood from many machines against availability; brute force = trying every combination.

Security · AI-written, may contain errors

Practice this exam

This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.