VPN and Cryptographic Protocols Flashcards

In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

Answer: AH (Authentication Header)

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

Which VPN technology is most commonly used to provide clientless remote access through a web browser?

Answer: SSL/TLS VPN (clientless portal)

SSL/TLS VPNs can provide web-based access to applications without requiring a dedicated VPN client to be installed.

What is a 'split tunnel' VPN configuration?

Answer: A configuration where only traffic destined for corporate resources goes through the VPN

Split tunneling routes corporate-bound traffic through the encrypted VPN while internet traffic goes directly to the ISP, reducing VPN load.

Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

Answer: ECDH (Elliptic Curve Diffie-Hellman)

ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.

A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?

Answer: Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key

IKEv1 aggressive mode sends the peer's identity hash in cleartext, allowing an attacker to capture it and crack the pre-shared key offline.

What is the purpose of a Certificate Revocation List (CRL) in a VPN PKI deployment?

Answer: To identify certificates that have been revoked before their expiration date

A CRL allows VPN gateways to check whether a client or server certificate has been revoked due to compromise or policy change.