問74
頻出度★★★
無線LANにおいて, 端末とアクセスポイント間で伝送されているデータの盗聴を防止するために利用されるものはどれか。
平成27年度 春期 ITパスポート試験 問74
This question's explanation and your answers so far.
解説
問 74
Incorrectア
ANY connection rejection is a setting that refuses terminals which connect by specifying ANY or a blank value as the ESSID, meaning any nearby access point will do. It can reduce unauthorized terminals from connecting, but it only controls whether a connection is allowed; it does not encrypt the content of the radio waves actually being transmitted. Therefore it cannot prevent eavesdropping on intercepted data.
Incorrectイ
ESSID stealth is a concealment measure in which the access point stops broadcasting its own ESSID (network name) in beacons so that it is less likely to appear in the list of networks. It only makes the network harder to find; the communication data itself is not encrypted. Moreover, the ESSID can be inferred from other frames, so it is ineffective as a countermeasure against eavesdropping.
Incorrectウ
MAC address filtering is an access control that allows only terminals with registered MAC addresses to connect. It is a means of restricting unauthorized terminals from connecting and has no function to conceal the communication content. Furthermore, MAC addresses travel over the air in plaintext and can be spoofed (impersonated), so this is not a countermeasure against eavesdropping.
- エ
正解 The correct answer is エ, WPA2. A wireless LAN uses radio waves, so any third party within range can receive the radio signal itself. To prevent eavesdropping (having the contents read from intercepted radio waves), the only option is to encrypt the communication content itself so that it becomes meaningless data to anyone without the key. WPA2 is a wireless LAN security standard that provides strong encryption with AES (CCMP) together with device authentication. Because the data cannot be decrypted even if the radio waves are intercepted, WPA2 is effective at preventing eavesdropping on data in transit. Note that WEP, the predecessor of WPA2, has vulnerabilities in its encryption method and can be broken in a short time, so today WPA2 or later (including WPA3) is recommended.
ここがポイント
- The direct countermeasure against eavesdropping (having intercepted communication content read) is encryption, and in a wireless LAN this role is played by security standards such as WPA2 / WPA3. WEP is vulnerable and should not be used.
- ESSID stealth, MAC address filtering, and ANY connection rejection are all mechanisms that control who is allowed to connect (countermeasures against unauthorized access), not countermeasures that keep the flowing data from being read. Distinguish the choices by this difference in purpose.
用語