問81
頻出度★★★
無線LAN のセキュリティにおいて, アクセスポイントが接続要求を受け取ったときに, 端末固有の情報を基にアクセス制御を行う仕組みはどれか。
平成25年度 秋期 ITパスポート試験 問81
This question's explanation and your answers so far.
解説
問 81
Incorrectア
An ESSID is the identifying name given to a wireless LAN network (a name on the network side), not information unique to a terminal. Anyone whose terminal knows the same ESSID can try to connect, so it cannot serve as access control that decides permission per terminal. Even if the ESSID is made stealth (not announced), it can still be found out by analyzing the radio signals.
- イ
正解 The correct answer is （イ）MAC address filtering. A MAC address is a 48-bit unique identifier assigned at manufacturing time to each LAN network interface (a wireless LAN client adapter), and it is exactly the information unique to a terminal that the question refers to. If you register on the access point, in advance, a list of the MAC addresses of terminals allowed to connect, then when a connection request arrives the access point checks the source MAC address of that request against the list, permitting the connection if it is registered and rejecting it if it is not. This is MAC address filtering: it is not encryption but an access control mechanism that decides which terminals may connect. Note also that a MAC address travels over the air in plain text and can be spoofed (impersonated), so it is not strong on its own; it is a supplementary measure meant to be used together with encryption and authentication such as WPA2/WPA3.
Incorrectウ
WEP is an old standard for encrypting communication over the wireless section. It merely controls connection by whether the shared key is known, and it does not look at information unique to a terminal. Moreover, its encryption scheme has vulnerabilities and the key can be cracked in a short time, so its use is not recommended today.
Incorrectエ
WPA is a wireless LAN encryption and authentication standard that improved on the vulnerabilities of WEP; it protects the content of communication and authenticates the user (or the shared key). It is not a mechanism that checks an identifier unique to a terminal against a list in order to permit or reject a connection request, so it does not match the description in the question.
ここがポイント
- MAC address filtering = access control that checks the source of a connection request against the MAC addresses (identifiers unique to network interfaces) registered on the access point, and lets only permitted terminals connect.
- Distinguish the roles of wireless LAN terms: ESSID = the name identifying a network; WEP/WPA (WPA2, WPA3) = standards for encrypting and authenticating communication; MAC address filtering = per-terminal control of whether connection is allowed. Because a MAC address can be spoofed, filtering is a supplementary measure premised on being combined with encryption.
用語