VPN and Cryptographic Protocols Flashcards

Which IPsec mode encapsulates the entire original IP packet, including the header, and is used for gateway-to-gateway VPNs?

Answer: Tunnel mode

Tunnel mode wraps the entire original IP packet inside a new IP packet with a new header, hiding the original source and destination.

What cryptographic property ensures that a sender cannot deny having sent a message?

Answer: Non-repudiation

Non-repudiation, achieved through digital signatures, provides proof of origin that the sender cannot later deny.

Which protocol replaces PPTP and provides stronger security when combined with IPsec?

Answer: L2TP/IPsec

L2TP provides tunneling while IPsec adds encryption and authentication, making L2TP/IPsec a more secure replacement for PPTP.

A CNDA is evaluating VPN protocols. Which modern protocol is known for minimal codebase, high performance, and use of state-of-the-art cryptography?

Answer: WireGuard

WireGuard uses a ~4,000-line codebase, ChaCha20/Poly1305 encryption, and Curve25519 key exchange, offering simplicity and high performance.

What does the Diffie-Hellman algorithm accomplish in a VPN key exchange?

Answer: It allows two parties to establish a shared secret over an untrusted channel without prior shared information

Diffie-Hellman enables two parties to derive the same shared secret using public values exchanged over an insecure channel.

Which VPN deployment concern is addressed by using multi-factor authentication (MFA) at the VPN gateway?

Answer: Credential theft or stolen VPN credentials enabling unauthorized access

MFA requires a second factor beyond username and password, so stolen credentials alone are insufficient to gain VPN access.