IS3220 CHAPTER 12 Flashcards
This provides integrity protection for packet headers and data, as well as user authentication. It can optionally provide replay protection and access protection.. It cannot encrypt any portion of a packet. Because authentication capabilities were added to ESP in the seconder version of IPSec, this has become less significant. But, it still has value because it can authenticate portions of packets that ESP cannot. This is called ___?
AUTHENTICATION HEADER (AH)
This is the second core IPSec security protocol in NISTs Guide to IPsec VPNs notes. Initially, this provided only encryption for packet payload data. Integrity protection was provided by the AH protocol if needed. The next version became more flexible. It can perform authentication to provide integrity protection, although not for the outermost IP header. This is called
ENCAPSULATING SECURITY PAYLOAD (ESP)
This is the standards body for internet-related engineering specifications.. It uses RFCs as a mechanism to define internet-related standards and is called ___?
INTERNET ENGINEERING TASK FORCE (IETF)
This negotiates, creates, and manages security associations. Security association (SA) is a generic term for a set of values that define the IPSec features and protections applied to a connection. You can also create SAs manually, using values agreed on in advance by both parties, but because these SAs cannot be updated, this method does not scale for real-life large-scale VPNs. In IPSec, this provides a secure mechanism for establishing IPSec-protected connections and is this is called ___?
INTERNET KEY EXCHANGE (IKE)
353
LAYER 2 FORWARDING (L2F)
This is an older protocol largely replaced by IPSec and SSL/TLS-based VPNs in production environments. This was used extensively in the early VPN solutions, but lost its popularity as other protocols proved to be more usable as industry standards developed. This is called ___?
LAYER 2 TUNNELING PROTOCOL (L2TP)
This was a protocol defined to provide a standard transport mechanism. This was used largely in conjunction with modem connections and has been phased out as high-speed internet connections have replaced modem connections. This is called ___?
POINT-TO-POINT PROTOCOL (PPP)
This protocol supports Microsoft’s remote access servers and has known issues. It uses Microsoft Point-to-point Encryption and is still used for some remote access solutions, IPSec and SSL-based solutions are replacing it. This is called ___?
POINT-TO-POINT TUNNELING PROTOCOL (PPTP)
A document that defines or describes computer and networking technologies. These exist for hardware, operating systems, protocols, security services and more. This is called ___?
REQUEST FOR COMMENT (RFC)
A network protocol that allows data exchange using a secure channel between two networked devices. It is used primarily on GNU/Linux and UNIX based systems to access shell accounts. This was a replacement for Telnet and other insecure remote shoes, which send information, notably passwords, in plaintext, rendering them susceptible to packet analysis. This is called ___?
SECURE SHELL (SSH)
- What are the two modes supported by IPSec?
(Multiple answers are correct) - Transition
- Tunnel
- Encrypted
- Transport
- Internally connected
Tunnel
Transport
- All the following are considered IPSec service EXCEPT:
(Multiple answers may be correct) - Access control
- Encryption
- NAT interoperability
- Replay rejection
- Support for AES encryption
NAT interoperability
Support for AES encryption
- The strongest encryption protocol currently supported by IPSec is ___?
3DES
- The two different protocols commonly used for remote access VPN are ___ and ___.
SSL and IPSec
- Select two advantages of using an IPSec-based VPN solution instead of an SSL-based solution.
(Multiple answers are correct) - Provides direct connection to the network
- Since IPSec works at Layer 3, it can support virtually all network applications
- Requires configuration of each application being accessed via the VPN
- Client-less solution
Provides direct connection to the network
Since IPSec works at Layer 3, it can support virtually all network applications
- A solution that permitted industry to extend the life of IPv4 addresses is ___.
network address translation (NAT)
7. Which of the following are benefits of using an SSL VPN? (Multiple answers may be correct) 1. More costly 2. Less flexible 3. Support for NAT 4. Fewer firewall rules 5. Used for secure logins
Support for NAT
Fewer firewall rules
- SSL VPNs are considered ____ because access is granted through SSL, which is supported by Web browsers on virtually all platforms.
platform independent
9. Which of the following are areas that can impact the stability of your VPN? (Multiple answers may be correct) 1. Number of users 2. VPN Configuration 3. Code Revision Level 4. Operating System 5. Encryption Level
VPN Configuration
Code Revision Level
Operating System
- Which of the following are types of Network Address Translation? (Multiple answers may be correct)
- On Demand
- Dynamic
- Secure
- Static
- Encrypted
Dynamic
Static
- The mechanism used by the IETF to document internet standards is the ___.
request for comment (RFC)
- Separating the physical devices from the logical devices is known as ___.
.virtualization
13. Which of the following are uses for the SSH protocol? (Multiple answers may be correct) 1. Secure Remote Login 2. Secure File Transfers 3. Secure access to a Web site 4. Encrypting data on backup tapes 5. Creating a VPN connection
Secure Remote Login
Secure File Transfers
Creating a VPN connection
- The L2TP protocol was created by the combination of these two protocols: ___ and ___.
L2F and PPTP
- When you need to securely connect to a router for remote login, ___ would be the recommended protocol.
SSH
- Which of the following are protocols that can be used for a VPN connection? (Multiple answers may be correct)
- IPSec
- 3DES
- SSH
- IETF
- SSL
IPSec
SSH
SSL
- When working with IPSec in an environment using network address translation, which protocols and ports need to be open for IPSec to communicate?
(Multiple answers may be correct) - (IKE) __ User Datagram Protocol (UDP) port 500
- Internet Key Exchange – UDP port 500
- Encapsulating Security Payload – IP port 50
- Secure Sockets Layer __ TCP port 443
- Authentication Header – IP protocol number 51
Internet Key Exchange – UDP port 500
Encapsulating Security Payload – IP port 50
Authentication Header – IP protocol number 51
- When designing a VPN solutions, which of the following areas could impact VPN performance? (Multiple answers may be correct)
- Available bandwidth
- Client configuration
- Client patch level
- Traffic
- Topology
Available bandwidth
Client configuration
Traffic
Topology
- Which of the following are benefits of IPv6?
(Multiple answers may be correct) - IPSec is defined as a native protocol
- Support for SSL included in the standard
- Ability to address a limit of 4.3 billion hosts
- Plug and Play configuration with or without DHCP
- Define how to respond to incidents
IPSec is defined as a native protocol
Plug and Play configuration with or without DHCP
- The ability to traverse a firewall using Network Address Translation on port 443 is a component of which VPN protocol ___?
Secure Socket Layer
