IPA FE Subject A 2025 Question 8
A question IPA Japan published in 令和７年度 基本情報技術者試験 科目A 公開問題 問8, translated into English. ITPEC is based on the same exams.
When HTTP and HTTPS are compared, which of the following shows a characteristic that only HTTPS has?
Explanation
Verifying the server by its server certificate — of the four features, only this one comes from TLS, the layer HTTPS adds under HTTP.
HTTPS is HTTP carried over TLS. During the TLS handshake the server presents its server certificate; the browser checks that a trusted CA signed it and that the domain name in it matches the site, so the client can confirm it is talking to the genuine server. TLS then encrypts the traffic and detects tampering. Plain HTTP has no such step, so anyone who intercepts the connection can pose as the server.
Everything HTTP itself does (cookies, caching, authentication) works the same over HTTP and HTTPS, so none of it is a feature only HTTPS has.
Answer (d)
Why not others:
- •(a) — cookies are HTTP headers (
Set-Cookie,Cookie), so session management with them works over plain HTTP too; HTTPS only protects the cookie in transit - •(b) — authentication by ID and password (HTTP Basic or Digest authentication, or a login form) is an HTTP function available without TLS, though the password then travels unprotected
- •(c) — browser caching is controlled by HTTP headers such as
Cache-Controland saves traffic over plain HTTP as well
Key rule: HTTPS = HTTP + TLS, and TLS adds server authentication by certificate, encryption and tamper detection; what HTTP already does is not unique to HTTPS.
Security · AI-written, may contain errors
This question comes from the past questions IPA Japan publishes, translated into English by ITPEC Practice. ITPEC Practice is an independent study tool and is not affiliated with IPA or ITPEC. See the original paper (PDF) or Report an issue.