問37
頻出度★★★
システムによる内部統制を目的として, 幾つかの機能を実装した。次の処理は, どの機能の実現例として適切か。 ログイン画面を表示して利用者 ID とパスワードを入力する。利用者 ID とパスワードの組合せがあらかじめ登録されている内容と一致する場合は業務メニュー画面に遷移する。一致しない場合は遷移せずにエラーメッセージを表示する。
令和4年度 ITパスポート試験 問37
This question's explanation and your answers so far.
解説
問 37
Incorrectア
“Detection of system failures” is a function that monitors and detects abnormalities or stoppages in hardware or software. The process in this question is a comparison of ID and password and contains no action that detects failures, so it is incorrect.
- イ
正解 This process takes the combination of the user ID and password entered on the login screen, checks it against the content registered in advance, lets only matching users proceed to the business menu screen, and, if they do not match, rejects them and shows an error message. This is the action of “confirming whether the person is legitimate (a registered, valid user) and allowing use of the system only when they are legitimate,” which is exactly an implementation example of access control by the system (authentication plus control over whether use is permitted). From the standpoint of internal control, it is also a basic control that blocks operations by unauthorized persons at the entry point, so the correct answer is イ.
Incorrectウ
“Granting access rights to users” is a management task that assigns in advance which operations (such as viewing or updating) a given user may perform on a given resource. The process in this question merely verifies identity at login and does not actually grant the rights themselves, so it is incorrect.
Incorrectエ
“Validation of the appropriateness of users’ password settings” is a function that checks whether the settings are adequate — for example, whether the password is long and complex enough and not easily guessed. The process in this question only checks whether the entered value matches the registered content and does not evaluate the strength or appropriateness of the password, so it is incorrect.
ここがポイント
- Access control = a mechanism that authenticates users (verifies identity) and allows only legitimate users to use the system or resources. Controlling whether a user may use the system through login ID and password verification is a typical example.
- Distinguishing confusable terms: “granting” access rights is the advance assignment of privileges, and “validating the appropriateness” of password settings is a strength check; both are functions separate from the identity verification at login (access control).
用語