CNDA VPN and Cryptographic Protocols 3

Question 1

Which IPsec mode encapsulates the entire original IP packet, including the header, and is used for gateway-to-gateway VPNs?

Accepted Answer

Tunnel mode

Answer

Tunnel mode wraps the entire original IP packet inside a new IP packet with a new header, hiding the original source and destination.

Question 2

What cryptographic property ensures that a sender cannot deny having sent a message?

Accepted Answer

Non-repudiation

Answer

Non-repudiation, achieved through digital signatures, provides proof of origin that the sender cannot later deny.

Question 3

Which protocol replaces PPTP and provides stronger security when combined with IPsec?

Accepted Answer

L2TP/IPsec

Answer

L2TP provides tunneling while IPsec adds encryption and authentication, making L2TP/IPsec a more secure replacement for PPTP.

Question 4

A CNDA is evaluating VPN protocols. Which modern protocol is known for minimal codebase, high performance, and use of state-of-the-art cryptography?

Accepted Answer

WireGuard

Answer

WireGuard uses a ~4,000-line codebase, ChaCha20/Poly1305 encryption, and Curve25519 key exchange, offering simplicity and high performance.

Question 5

What does the Diffie-Hellman algorithm accomplish in a VPN key exchange?

Accepted Answer

It allows two parties to establish a shared secret over an untrusted channel without prior shared information

Answer

Diffie-Hellman enables two parties to derive the same shared secret using public values exchanged over an insecure channel.

CNDA - Certified Network Defense Architect Practice Test