CNDA VPN and Cryptographic Protocols 1 — Questions and Answers
Question 1: Which VPN protocol provides both authentication and encryption at the IP layer using two modes?
- SSL/TLS VPN
- IPsec (Correct answer)
- PPTP
- L2TP without IPsec
Correct answer: IPsec
IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.
Question 2: What is the role of IKE (Internet Key Exchange) in an IPsec VPN?
- To encrypt the data payload
- To negotiate and establish the Security Associations (SAs) and exchange keys (Correct answer)
- To authenticate web certificates
- To compress VPN traffic
Correct answer: To negotiate and establish the Security Associations (SAs) and exchange keys
IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.
Question 3: Which symmetric encryption algorithm is recommended for IPsec VPN in modern CNDA implementations due to its security and performance?
- DES
- 3DES
- AES-256 (Correct answer)
- RC4
Correct answer: AES-256
AES-256 provides strong 256-bit encryption with hardware acceleration support and is the NIST-recommended standard for symmetric encryption.
Question 4: What is the primary difference between a site-to-site VPN and a remote-access VPN?
- Site-to-site uses SSL; remote access uses IPsec
- Site-to-site connects two networks permanently; remote access connects individual users dynamically (Correct answer)
- Remote access VPNs cannot use encryption
- Site-to-site VPNs require client software on every user machine
Correct answer: Site-to-site connects two networks permanently; remote access connects individual users dynamically
Site-to-site VPNs create a persistent encrypted tunnel between two network gateways, while remote access VPNs connect individual clients to a corporate network.
Question 5: Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?
- SHA-256
- SHA-3
- MD5 (Correct answer)
- SHA-512
Correct answer: MD5
MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.
Question 6: What does 'perfect forward secrecy' (PFS) protect against in a VPN?
- Replay attacks
- Compromise of the long-term private key exposing past session keys (Correct answer)
- Eavesdropping on the initial handshake
- DNS leaks in VPN tunnels
Correct answer: Compromise of the long-term private key exposing past session keys
PFS generates ephemeral session keys so that compromising the long-term key does not allow decryption of previously recorded sessions.
CNDA VPN and Cryptographic Protocols 1
Which VPN protocol provides both authentication and encryption at the IP layer using two modes?