問77
頻出度★★★
出所が不明のプログラムファイルの使用を避けるために, その発行元を調べたい。 このときに確認する情報として, 適切なものはどれか。
令和6年度 ITパスポート試験 問77
This question's explanation and your answers so far.
解説
問 77
Incorrectア
Access rights are information indicating who may read, write, or execute the file — merely a permission setting on the OS. They do not reveal who the publisher that created and distributed the file is, so this is inappropriate.
Incorrectイ
The owner information only indicates the account that owns the file on the OS (such as the user who saved it), and is unrelated to the software’s publisher (the organization that created and distributed it). Anyone can rewrite it, and it offers no guarantee of the publisher, so this is inappropriate.
- ウ
正解 Checking the program file’s “digital signature” is the appropriate choice. The software distributor (publisher) attaches a digital signature (code signing) to the file using a digital certificate issued by a trusted certificate authority (CA). By verifying the signature, the user can confirm both: (1) the publisher’s identity, i.e. who issued it, and (2) that the file has not been tampered with after distribution. Therefore, the option that directly matches the goal of identifying the publisher of a file of unknown origin is “ウ”.
Incorrectエ
A hash value is a fixed-length value calculated from the file’s contents, used for tamper detection (checking whether the contents have changed). While comparing it against the value published by the distributor can verify integrity, the hash value itself does not indicate who the publisher is, so it is inappropriate for the goal of identifying the publisher.
ここがポイント
- A digital signature (code signing), via the accompanying digital certificate, achieves both verification of the publisher’s identity and tamper detection.
- A hash value ensures only integrity (tamper detection), while access rights and owner information merely indicate permissions/ownership on the OS — none of them prove the publisher.
用語