Skip to content

平成30年度 春期 ITパスポート試験 問100

This question's explanation and your answers so far.

問100
頻出度★★★

仮想的に二つのESSIDをもつ無線LANアクセスポイントを使用して,PC,タブレット,ゲーム機などの機器をインターネットに接続している。それぞれのESSIDを次の設定で使用する場合,WEPの暗号化方式の脆弱性によって,外部から無線LANに不正アクセスされたときに発生しやすい被害はどれか。

ESSID1ESSID2
設定暗号化方式WPA2WEP
暗号化キーESSID2のものとは異なるキーESSID1のものとは異なるキー
通信制限なし接続した機器から管理画面とLAN内の他の機器への通信は拒否
使用方法PC,タブレットを接続ゲーム機だけを接続
出典 平成30年度 春期 ITパスポート試験 問100
解説

問 100

  • Incorrectア

    ESSID1 uses WPA2, and its encryption key is set separately from that of ESSID2. All the attacker can crack is the key of ESSID2, which uses WEP, and the access point never passes the WPA2 key of ESSID1 over to the ESSID2 side. Therefore the encryption key of ESSID1 is not leaked.

  • Incorrectイ

    The PC is connected to ESSID1, which uses WPA2, and its communication is protected by WPA2 that is hard to crack. The attacker has only broken into ESSID2, which uses a different key, and cannot decrypt the encryption of ESSID1, so the attacker cannot eavesdrop on the content of communication from the PC to the Internet.

  • ウ

    正解 WEP is a weak encryption method that is easily cracked, so an outside attacker first breaks into ESSID2, which uses WEP. The communication restriction on ESSID2 denies communication to the access point's management screen and to other devices in the LAN, so the attacker cannot rewrite the access point settings or reach the PCs and tablets on the ESSID1 side. However, this restriction does not block communication to the Internet. Therefore the real harm the attacker can still cause is to use the compromised ESSID2 as a stepping stone and freeload on (illegally use) the Internet connection line. This is the harm that is likely to occur, so the correct answer is ウ.

  • Incorrectエ

    The tablet is connected on the ESSID1 side. Because ESSID2 has the restriction that communication from a connected device to other devices in the LAN is denied, an attacker who breaks into ESSID2 cannot reach the tablet and therefore cannot gain illegal access.

ここがポイント
  • WEP is a weak method whose encryption is easily cracked, so an ESSID that uses it easily becomes an entry point for intrusion. The design goal is to contain the scope of damage by separating the encryption key for each ESSID and restricting communication within the LAN and to the management screen.
  • The communication restriction on ESSID2 blocks only communication to the management screen and to other devices in the LAN, while communication toward the Internet remains allowed. The key point is to recognize that the harm of an intruder freeloading on (illegally using) the Internet line still remains.
用語
解答問100ウ
Practise this question

Your answers