問55
頻出度★★★
ワンタイムパスワードに関する記述中の a，b に入れる字句の適切な組合せはどれか。 利用者は，トークンと呼ばれる装置などを用いて生成された [ a ] のパスワードを使って認証を受ける。このパスワードをワンタイムパスワードと呼び，これを利用することで，パスワードの漏えいによる [ b ] のリスクを低減することができる。
平成27年度 秋期 ITパスポート試験 問55
This question's explanation and your answers so far.
解説
問 55
Incorrectア
a = fixed is wrong. A one-time password is a single-use disposable password, the exact opposite of a fixed password (the same every time and reusable). b = DoS attack is also wrong; a DoS attack disrupts a service by overloading it, is unrelated to password leakage, and cannot be reduced by a one-time password.
Incorrectイ
b = impersonation is correct, but a = fixed is wrong. The one-time password generated by the token changes at each authentication and is disposable, not a fixed password.
Incorrectウ
a = one-time is correct, but b = DoS attack is wrong. The risk associated with password leakage is impersonation; a DoS attack (denial of service) is unrelated to password leakage and cannot be mitigated by a one-time password.
- エ
正解 The correct answer is エ (a = one-time / b = impersonation). A one-time password is a disposable password generated at each authentication by a device such as a token and becomes invalid once used, so “one-time” goes in a. Even if this password is leaked, it has already been used (or has expired) and cannot be reused, so it prevents an attacker from using a stolen password to impersonate a legitimate user and pass authentication. Therefore “impersonation” goes in b, and the risk of impersonation can be reduced.
ここがポイント
- A one-time password is a disposable password generated at each authentication by a device such as a token and becomes invalid after a single use; even if eavesdropped or leaked, it cannot be reused.
- It reduces the risk of impersonation that abuses a leaked password. A DoS attack (denial of service) is unrelated to password leakage and is not a countermeasure.
用語