問71
頻出度★★★
インターネットバンキングなどの Web サイトで利用されているリスクベース認証の例として, 適切なものはどれか。
令和8年度 ITパスポート試験 問71
This question's explanation and your answers so far.
解説
問 71
- ア
正解 Risk-based authentication is a mechanism that analyzes the conditions at login (the device used, source IP, region, time of day, operation habits, and so on) and requests additional authentication only for access judged to be unusual and ‘high risk’ compared with normal patterns. In choice ア, the system detects the ‘unusual situation = high risk’ that the user logged in from a PC different from the one they normally use, and performs additional authentication using a secret question that only the user knows. This is exactly the idea of risk-based authentication, namely dynamically changing the strength of authentication according to the situation, so it is the appropriate example.
Incorrectイ
Automatically logging the user out and asking them to log in again because there was no activity for a certain period is a function of ‘session timeout (automatic logoff).’ Although it is a countermeasure against takeover of an unattended device, it does not judge the level of access risk and change the strength of authentication, so it is not an example of risk-based authentication.
Incorrectウ
Locking the account because the wrong password was entered several times in a row is ‘account lock (lockout),’ a countermeasure against brute-force attacks and the like. Rather than imposing additional authentication according to the situation, it mechanically shuts the user out after a fixed number of failures, so it differs from risk-based authentication.
Incorrectエ
Prompting the user to change the password because it has not been changed for a long time is an operation based on ‘password expiration (password aging).’ It is a measure to prevent the continued reuse of an old password, not something that evaluates the risk of the login situation and strengthens authentication, so it is not an example of risk-based authentication.
ここがポイント
- Risk-based authentication = a mechanism that analyzes the conditions at login (device, IP, region, time of day, etc.) and imposes additional authentication only for unusual, high-risk access.
- Distinguish from similar-looking mechanisms: automatic logout = session timeout, shutting the user out after consecutive failures = account lock, periodic change requests = password expiration. None of them performs dynamic risk judgment.
用語