Module 8 - VPN and IPsec Concepts Review

Front

What is the function of the Hashed Message Authentication Code (HMAC) algorithm in setting up an IPsec VPN?

Back

guarantees message integrity

Answer explanation

The IPsec framework uses various protocols and algorithms to provide data confidentiality, data integrity, authentication, and secure key exchange. The Hashed Message Authentication Code (HMAC) is a data integrity algorithm that uses a hash value to guarantee the integrity of a message.

Front

Which protocol creates a virtual point-to-point connection to tunnel unencrypted traffic between Cisco routers from a variety of protocols?

Back

GRE

Answer explanation

Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco that encapsulates multiprotocol traffic between remote Cisco routers. GRE does not encrypt data. OSPF is a open source routing protocol. IPsec is a suite of protocols that allow for the exchange of information that can be encrypted and verified. Internet Key Exchange (IKE) is a key management standard used with IPsec.

Front

Which VPN solution allows the use of a web browser to establish a secure, remote-access VPN tunnel to the ASA?

Back

clientless SSL

Answer explanation

When a web browser is used to securely access the corporate network, the browser must use a secure version of HTTP to provide SSL encryption. A VPN client is not required to be installed on the remote host, so a clientless SSL connection is used.

Front

Which IPsec security function provides assurance that the data received via a VPN has not been modified in transit?

Back

integrity

Answer explanation

Integrity is a function of IPsec and ensures data arrives unchanged at the destination through the use of a hash algorithm. Confidentiality is a function of IPsec and utilizes encryption to protect data transfers with a key. Authentication is a function of IPsec and provides specific access to users and devices with valid authentication factors. Secure key exchange is a function of IPsec and allows two peers to maintain their private key confidentiality while sharing their public key.

Front

Which is a requirement of a site-to-site VPN?

Back

It requires a VPN gateway at each end of the tunnel to encrypt and decrypt traffic.

Answer explanation

Site-to-site VPNs are static and are used to connect entire networks. Hosts have no knowledge of the VPN and send TCP/IP traffic to VPN gateways. The VPN gateway is responsible for encapsulating the traffic and forwarding it through the VPN tunnel to a peer gateway at the other end which decapsulates the traffic.

Front

What is the function of the Diffie-Hellman algorithm within the IPsec framework?

Back

allows peers to exchange shared keys

Answer explanation

The IPsec framework uses various protocols and algorithms to provide data confidentiality, data integrity, authentication, and secure key exchange. DH (Diffie-Hellman) is an algorithm used for key exchange. DH is a public key exchange method that allows two IPsec peers to establish a shared secret key over an insecure channel.

Front

How is "tunneling" accomplished in a VPN?

Back

New headers from one or more VPN protocols encapsulate the original packets.

Answer explanation

Packets in a VPN are encapsulated with the headers from one or more VPN protocols before being sent across the third party network. This is referred to as "tunneling". These outer headers can be used to route the packets, authenticate the source, and prevent unauthorized users from reading the contents of the packets.

Front

Which statement describes a VPN?

Back

VPNs use virtual connections to create a private network through a public network.

Answer explanation

A VPN is a private network that is created over a public network. Instead of using dedicated physical connections, a VPN uses virtual connections routed through a public network between two network devices.

Front

Which type of VPN supports multiple sites by applying configurations to virtual interfaces instead of physical interfaces?

Back

IPsec virtual tunnel interface

Front

Which type of VPN connects using the Transport Layer Security (TLS) feature?

Back

SSL VPN