NSE Network Security Protocols & Technologies 2 — Questions and Answers
Question 1: Which IPsec mode encapsulates the entire original IP packet, including its header, inside a new IP packet?
- Transport mode
- Tunnel mode (Correct answer)
- AH mode
- ESP mode
Correct answer: Tunnel mode
Tunnel mode encapsulates the entire original IP packet within a new IP packet, making it ideal for VPN gateways.
Question 2: What is the primary function of the SSL/TLS handshake process?
- Encrypting bulk data transfer
- Negotiating cipher suites and exchanging keys (Correct answer)
- Authenticating end users to the server
- Compressing HTTP headers
Correct answer: Negotiating cipher suites and exchanging keys
The TLS handshake negotiates cipher suites, authenticates the server (and optionally the client), and establishes session keys.
Question 3: Which protocol provides network access control by authenticating devices before granting LAN or WLAN access?
- RADIUS
- 802.1X (Correct answer)
- TACACS+
- Kerberos
Correct answer: 802.1X
IEEE 802.1X is a port-based NAC standard that requires authentication before a device can access the network.
Question 4: What distinguishes TACACS+ from RADIUS in terms of protocol and separation of functions?
- TACACS+ uses UDP and combines AAA; RADIUS uses TCP and separates AAA
- TACACS+ uses TCP and separates authentication from authorization; RADIUS uses UDP and combines them (Correct answer)
- Both use TCP but TACACS+ encrypts only the password
- RADIUS uses TCP and separates AAA; TACACS+ uses UDP and combines them
Correct answer: TACACS+ uses TCP and separates authentication from authorization; RADIUS uses UDP and combines them
TACACS+ uses TCP and separates authentication, authorization, and accounting into distinct functions, while RADIUS uses UDP and combines authentication and authorization.
Question 5: In the context of WPA3-Enterprise, what key exchange method replaces the Pre-Shared Key to provide forward secrecy?
- RSA key exchange
- Simultaneous Authentication of Equals (SAE)
- Diffie-Hellman Ephemeral (DHE)
- Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) (Correct answer)
Correct answer: Elliptic Curve Diffie-Hellman Ephemeral (ECDHE)
WPA3-Enterprise mandates ECDHE-based cipher suites to ensure perfect forward secrecy for each session.
Question 6: Which DNSSEC record type contains the cryptographic signature over a set of DNS resource records?
- DS
- DNSKEY
- RRSIG (Correct answer)
- NSEC
Correct answer: RRSIG
The RRSIG (Resource Record Signature) record holds the digital signature that validators use to verify the authenticity of DNS data.
Question 7: What is the role of OCSP Stapling in TLS certificate validation?
- It pins the certificate to the browser's trust store
- It allows the server to cache and deliver the OCSP response to clients (Correct answer)
- It revokes expired certificates automatically
- It replaces CRLs with a real-time database lookup by the CA
Correct answer: It allows the server to cache and deliver the OCSP response to clients
OCSP Stapling lets the server attach a pre-fetched, CA-signed OCSP response to the TLS handshake, reducing latency and privacy concerns.
NSE Network Security Protocols & Technologies 2
Which IPsec mode encapsulates the entire original IP packet, including its header, inside a new IP packet?