CNDA VPN and Cryptographic Protocols

Question 1

Which VPN protocol provides both authentication and encryption at the IP layer using two modes?

Accepted Answer

IPsec

Answer

IPsec operates at Layer 3 and provides confidentiality, integrity, and authentication through Transport or Tunnel mode.

Question 2

What is the role of IKE (Internet Key Exchange) in an IPsec VPN?

Accepted Answer

To negotiate and establish the Security Associations (SAs) and exchange keys

Answer

IKE automates the negotiation of cryptographic parameters and key exchange needed to establish IPsec Security Associations.

Question 3

Which symmetric encryption algorithm is recommended for IPsec VPN in modern CNDA implementations due to its security and performance?

Accepted Answer

AES-256

Answer

AES-256 provides strong 256-bit encryption with hardware acceleration support and is the NIST-recommended standard for symmetric encryption.

Question 4

What is the primary difference between a site-to-site VPN and a remote-access VPN?

Accepted Answer

Site-to-site connects two networks permanently; remote access connects individual users dynamically

Answer

Site-to-site VPNs create a persistent encrypted tunnel between two network gateways, while remote access VPNs connect individual clients to a corporate network.

Question 5

Which hashing algorithm is considered cryptographically broken and should NOT be used in VPN configurations?

Accepted Answer

MD5

Answer

MD5 is vulnerable to collision attacks and has been broken, making it unsuitable for use in cryptographic security protocols.

CNDA - Certified Network Defense Architect Practice Test

CNDA - Certified Network Defense Architect Practice Test

CNDA VPN and Cryptographic Protocols