CNDA VPN and Cryptographic Protocols 2

Question 1

In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

Accepted Answer

AH (Authentication Header)

Answer

ESP (Encapsulating Security Payload)

Answer

IKEv2

Answer

GRE

Question 2

Which VPN technology is most commonly used to provide clientless remote access through a web browser?

Accepted Answer

SSL/TLS VPN (clientless portal)

Answer

IPsec tunnel mode

Answer

L2TP

Answer

MPLS VPN

Question 3

What is a 'split tunnel' VPN configuration?

Accepted Answer

A configuration where only traffic destined for corporate resources goes through the VPN

Answer

A VPN with two simultaneous connections to different servers

Answer

A VPN that splits encryption between two algorithms

Answer

A redundant VPN with automatic failover

Question 4

Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

Accepted Answer

ECDH (Elliptic Curve Diffie-Hellman)

Answer

RSA 1024

Answer

DH Group 1

Answer

Static key exchange

Question 5

A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?

Accepted Answer

Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key

Answer

Aggressive mode uses stronger encryption

Answer

IKEv1 cannot establish tunnels

Answer

Aggressive mode requires digital certificates

Question 6

What is the purpose of a Certificate Revocation List (CRL) in a VPN PKI deployment?

Accepted Answer

To identify certificates that have been revoked before their expiration date

Answer

To list all trusted root CAs

Answer

To store private keys securely

Answer

To assign IP addresses to VPN clients