問59
頻出度★★★
ログイン機能をもつ Web サイトに対する, パスワードの盗聴と総当たり攻撃へのそれぞれの対策の組合せとして, 最も適切なものはどれか。
平成31年度 春期 ITパスポート試験 問59
This question's explanation and your answers so far.
解説
問 59
Incorrectア
The eavesdropping countermeasure, sending over encrypted communication, is correct, but the brute-force countermeasure, using single sign-on, is wrong. Single sign-on is a convenience mechanism that lets you use multiple services with a single authentication; it does not prevent a brute-force attack that tries passwords one after another.
- イ
正解 The countermeasure against password eavesdropping (having the content intercepted during transmission) is to encrypt the communication itself before sending the password. If it is encrypted with SSL/TLS, the content cannot be read even when intercepted on the path. On the other hand, the countermeasure against a brute-force attack (an attack that tries passwords one after another) is to limit the number of password entry attempts (locking the account after a set number of failures), which blocks unlimited tries. Only イ correctly combines these two, so イ is the correct answer.
Incorrectウ
Both are wrong. For the eavesdropping countermeasure, setting a hard-to-guess string as the password does not work against eavesdropping, because even a strong password leaks its content if the communication is intercepted. The brute-force countermeasure, single sign-on, also cannot prevent a brute-force attack because it does not limit the number of attempts.
Incorrectエ
The brute-force countermeasure, limiting the number of entry attempts, is correct, but the eavesdropping countermeasure, setting a hard-to-guess string as the password, is wrong. A strong, hard-to-guess password is effective against brute-force or guessing, but it cannot prevent the interception (eavesdropping) of the communication itself; without encryption, it will still be read on the path.
ここがポイント
- The countermeasure against password eavesdropping (interception of communication) is encrypting the communication (SSL/TLS). Even a strong password leaks on the path if the communication is not encrypted.
- The countermeasure against a brute-force attack is limiting the number of entry attempts (account lockout). Single sign-on is a convenience mechanism, not a countermeasure against attacks.
用語