問63
頻出度★★★
パスワード管理に関する記述のうち, 適切なものはどれか。
平成30年度 春期 ITパスポート試験 問63
This question's explanation and your answers so far.
解説
問 63
- ア
正解 The correct answer is “ア”. Not reusing the password used in the business system for private Internet services is a basic principle of password management. If information leaks from the private service side, the business system that used the same password is also exposed to the risk of unauthorized access (a so-called password list attack, also known as credential stuffing). Setting a different password for each purpose to break the chain of damage is the proper practice, and only “ア” follows this principle.
Incorrectイ
The initial password is a default value set by the administrator; it may be known to multiple users and is easy to guess. Rather than leaving it untouched until you get used to the login operation, you should immediately change it at first login to a value known only to yourself, so this option is inappropriate.
Incorrectウ
If you reuse just a few passwords over and over, the moment one of them leaks, multiple systems are put at risk at the same time. Reuse is a typical bad example that widens the damage of a password list attack (credential stuffing), so it is not appropriate.
Incorrectエ
If you store the password in a file as plaintext (the raw, unencrypted string), it can be easily read when the PC is stolen or infected by malware. The principle is not to store passwords in plaintext, so this option is inappropriate.
ここがポイント
- Use a different password for each purpose (each system) and do not reuse them; this prevents a leak in one place from spreading to others (a countermeasure against password list attacks).
- Change the initial password promptly at first login and avoid storing it in plaintext — these are basic principles.
用語