CNDA VPN and Cryptographic Protocols 2 — Questions and Answers
Question 1: In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?
- ESP (Encapsulating Security Payload)
- AH (Authentication Header) (Correct answer)
- IKEv2
- GRE
Correct answer: AH (Authentication Header)
AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.
Question 2: Which VPN technology is most commonly used to provide clientless remote access through a web browser?
- IPsec tunnel mode
- SSL/TLS VPN (clientless portal) (Correct answer)
- L2TP
- MPLS VPN
Correct answer: SSL/TLS VPN (clientless portal)
SSL/TLS VPNs can provide web-based access to applications without requiring a dedicated VPN client to be installed.
Question 3: What is a 'split tunnel' VPN configuration?
- A VPN with two simultaneous connections to different servers
- A configuration where only traffic destined for corporate resources goes through the VPN (Correct answer)
- A VPN that splits encryption between two algorithms
- A redundant VPN with automatic failover
Correct answer: A configuration where only traffic destined for corporate resources goes through the VPN
Split tunneling routes corporate-bound traffic through the encrypted VPN while internet traffic goes directly to the ISP, reducing VPN load.
Question 4: Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?
- RSA 1024
- ECDH (Elliptic Curve Diffie-Hellman) (Correct answer)
- DH Group 1
- Static key exchange
Correct answer: ECDH (Elliptic Curve Diffie-Hellman)
ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.
Question 5: A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?
- Aggressive mode uses stronger encryption
- Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key (Correct answer)
- IKEv1 cannot establish tunnels
- Aggressive mode requires digital certificates
Correct answer: Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key
IKEv1 aggressive mode sends the peer's identity hash in cleartext, allowing an attacker to capture it and crack the pre-shared key offline.
Question 6: What is the purpose of a Certificate Revocation List (CRL) in a VPN PKI deployment?
- To list all trusted root CAs
- To identify certificates that have been revoked before their expiration date (Correct answer)
- To store private keys securely
- To assign IP addresses to VPN clients
Correct answer: To identify certificates that have been revoked before their expiration date
A CRL allows VPN gateways to check whether a client or server certificate has been revoked due to compromise or policy change.
CNDA VPN and Cryptographic Protocols 2
In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?