CNDA VPN and Cryptographic Protocols 2

Question 1

In IPsec, which protocol provides data origin authentication and integrity but NOT confidentiality?

Accepted Answer

AH (Authentication Header)

Answer

AH provides integrity and authentication for IP packets but does not encrypt the payload, so it offers no confidentiality.

Question 2

Which VPN technology is most commonly used to provide clientless remote access through a web browser?

Accepted Answer

SSL/TLS VPN (clientless portal)

Answer

SSL/TLS VPNs can provide web-based access to applications without requiring a dedicated VPN client to be installed.

Question 3

What is a 'split tunnel' VPN configuration?

Accepted Answer

A configuration where only traffic destined for corporate resources goes through the VPN

Answer

Split tunneling routes corporate-bound traffic through the encrypted VPN while internet traffic goes directly to the ISP, reducing VPN load.

Question 4

Which key exchange protocol is used in IKEv2 to provide quantum-resistant capabilities when paired with post-quantum algorithms?

Accepted Answer

ECDH (Elliptic Curve Diffie-Hellman)

Answer

ECDH provides efficient key exchange with smaller key sizes, and when combined with post-quantum KEM algorithms, can resist quantum attacks.

Question 5

A CNDA discovers that a VPN gateway is still using IKEv1 with aggressive mode. What is the primary security concern?

Accepted Answer

Aggressive mode exposes the identity hash offline, enabling brute-force attacks on the pre-shared key

Answer

IKEv1 aggressive mode sends the peer's identity hash in cleartext, allowing an attacker to capture it and crack the pre-shared key offline.

CNDA - Certified Network Defense Architect Practice Test