CNDA VPN and Cryptographic Protocols

Question 1

Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

Accepted Answer

IPsec

Answer

SSL/TLS VPN

Answer

PPTP

Answer

L2TP without IPsec

Question 2

What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

Accepted Answer

To negotiate and establish the Security Associations (SAs) and exchange keys

Answer

To encrypt the data payload

Answer

To authenticate web certificates

Answer

To compress VPN traffic

Question 3

Which symmetric encryption algorithm is recommended for IPsec VPN in modern CNDA implementations due to its security and performance?

Accepted Answer

AES-256

Answer

DES

Answer

3DES

Answer

RC4

Question 4

What is the primary difference between a site-to-site VPN and a remote-access VPN?

Accepted Answer

Site-to-site connects two networks permanently; remote access connects individual users dynamically

Answer

Site-to-site uses SSL; remote access uses IPsec

Answer

Remote access VPNs cannot use encryption

Answer

Site-to-site VPNs require client software on every user machine

Question 5

Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

Accepted Answer

MD5

Answer

SHA-256

Answer

SHA-3

Answer

SHA-512

Question 6

What does 'perfect forward secrecy' (PFS) protect against in a VPN?

Accepted Answer

Compromise of the long-term private key exposing past session keys

Answer

Replay attacks

Answer

Eavesdropping on the initial handshake

Answer

DNS leaks in VPN tunnels