問60
頻出度★★★
情報システムにおける二段階認証の例として, 適切なものはどれか。
令和3年度 ITパスポート試験 問60
This question's explanation and your answers so far.
解説
問 60
Incorrectア
Having the user read and enter a distorted character-string image is CAPTCHA (a human check meant to exclude automated input by machines), not an authentication stage that verifies the user's own identity. In effect it is merely a single-stage authentication by ID and password, so it is not two-step verification.
Incorrectイ
This is an example of performing biometric authentication separately when entering and when leaving the server room, which merely carries out physical entry/exit control twice. It does not strengthen a single login (identity verification) by dividing it into two stages, so it cannot be called an example of two-step verification.
- ウ
正解 Two-step verification is a method that divides the authentication procedure into two stages, requiring a user who has passed the first stage to also undergo a second-stage authentication. In choice ウ, the user first authenticates with a user ID and password (first stage), and only after passing it does the user enter the answer to a secret question (second stage) to log in. Because two authentications are imposed in stages, this is an appropriate example of two-step verification.
Incorrectエ
This is a flow in which entering the user ID switches the screen to the password entry screen, and the user logs in by entering the password. Only the screen is split into two; the authentication itself is merely an ordinary single-stage authentication by ID and password, not two-step verification.
ここがポイント
- Two-step verification is a method that performs authentication in two stages in sequence, imposing a second-stage authentication after the first stage is passed (e.g., password plus secret question, as in choice ウ).
- Note that CAPTCHA (entering distorted characters) is a mechanism to check whether the user is human, not identity authentication, and that input which merely splits the screen does not add an authentication stage.
用語