This question's explanation and your answers so far.
問99
頻出度★★★
A社では，個人情報保護法に従って，個人情報を取り扱っている。Bさんが所属する営業部では，個人の顧客がインターネット上のA社のWebページに会員登録することで，商品購入ができるという事業を開始することになった。そこで，Bさんは会員登録をするWebページの仕組みとして，次の事項を考えた。
〔会員登録をするWebページの仕組み〕
① 個人情報の利用目的を記述したWebページを表示し，顧客が同意ボタンを押すと，個人情報を入力するWebページに移動する。
② 会員登録の項目としては，氏名，住所，電話番号，生年月日，性別，メールアドレス，ID及びパスワードがあり，これらは必ず入力してもらう。メールアドレスとパスワードについては，誤入力を防ぐために，同じ情報を2度入力してもらう。
③ Webページでの個人情報の入力が終了し，送信ボタンを押した後，入力情報を確認するWebページを表示し，顧客に入力の間違いがないかを確認してもらう。このとき，入力されたIDが他の会員によって既に登録されている場合，変更を求める。
④ 顧客が入力情報を確認し，登録ボタンを押した後，登録したメールアドレス宛に，A社の会員として登録された旨を伝える電子メール（以下，メールという）を送信する。
⑤ ②及び③における顧客のPCとA社のWebサーバとのデータのやり取りは，暗号化による通信を行う。
〔会員登録をする Web ページの仕組み〕の⑤の暗号化による通信で利用する仕組みとして, 適切なものはどれか。
出典 平成24年度 秋期 ITパスポート試験 問99
解説
問 99
//
×Incorrectア
HTML (HyperText Markup Language) is a markup language for describing, with tags, the structure and content of a Web page such as headings, paragraphs, and input forms. The input screen and the confirmation screen in ② and ③ themselves are indeed built with HTML, but that only defines the contents of the screens; it has no function to encrypt the data that flows between the PC and the Web server. It is not the mechanism for encrypted communication that ⑤ calls for.
×Incorrectイ
SMTP (Simple Mail Transfer Protocol) is a protocol for sending e-mail. It is related to the part in ④ that sends an e-mail notifying the completion of registration, but what ⑤ covers is the exchange of data between the customer's PC and the Web server in ② and ③, not the sending of e-mail. Furthermore, SMTP itself is originally a protocol that has no encryption mechanism, so it does not play the role of encrypted communication either.
○ウ
正解⑤ is the mechanism that encrypts the data exchanged between the customer's PC and Company A's Web server during the member registration input in ② and the confirmation of the entered content in ③. What is exchanged here is personal information itself — name, address, phone number, date of birth, gender, e-mail address, ID, and password — so it must be protected from being eavesdropped on or tampered with on the communication path along the way. The representative mechanism that plays this role of encrypting the communication between the Web browser (PC) and the Web server is SSL (Secure Sockets Layer). When SSL is used, the URL starts with https:// and a padlock icon is shown in the browser. In addition to encrypting the content of the communication (preventing eavesdropping), SSL also verifies the other party of the communication (the Web server) with a server certificate and detects tampering. Therefore ウ is appropriate. Note that the technology actually used today is TLS, the successor to SSL, and the IT Passport exam also covers them together as SSL/TLS.
×Incorrectエ
XML (eXtensible Markup Language) is a markup language that describes the meaning and structure of data with tags so that data can be exchanged easily between different systems. It defines the representation format of data; it is not a mechanism that encrypts and protects data on the communication path. Even data written in XML will have its content read if it is sent as it is.
ここがポイント
SSL/TLS is a protocol that encrypts the communication between a Web browser and a Web server. Besides preventing eavesdropping and tampering, it also verifies the other party of the communication with a server certificate. It is essential on screens where personal information or a password is entered and sent; there the URL becomes https:// and a padlock icon is displayed.
Distinguish similar abbreviations by layer — HTML and XML are markup languages that describe content and structure, SMTP is a protocol that sends e-mail, and SSL/TLS is a protocol that encrypts communication. Choose based on what the mechanism protects.