C7 - Quiz

Which protocol creates a virtual point-to-point connection to tunnel unencrypted traffic between Cisco routers from a variety of protocols?

• OSPF

• IPsec

• IKE

• GRE

Answer explanation

• Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco that encapsulates multiprotocol traffic between remote Cisco routers. GRE does not encrypt data. OSPF is a open source routing protocol. IPsec is a suite of protocols that allow for the exchange of information that can be encrypted and verified. Internet Key Exchange (IKE) is a key management standard used with IPsec.

Which is a requirement of a site-to-site VPN?

• 
  It requires a client/server architecture.

• 
  It requires the placement of a VPN server at the edge of the company network.

• 
  It requires hosts to use VPN client software to encapsulate traffic.

• It requires a VPN gateway at each end of the tunnel to encrypt and decrypt traffic.

Answer explanation

• Site-to-site VPNs are static and are used to connect entire networks. Hosts have no knowledge of the VPN and send TCP/IP traffic to VPN gateways. The VPN gateway is responsible for encapsulating the traffic and forwarding it through the VPN tunnel to a peer gateway at the other end which decapsulates the traffic.

Which two statements describe a remote access VPN? (Choose two.)

• 
  It connects entire networks to each other.

• 
  It requires hosts to send TCP/IP traffic through a VPN gateway.

• 
  It is used to connect individual hosts securely to a company network over the Internet.

• 
  It may require VPN client software on hosts.

• It requires static configuration of the VPN tunnel.

Answer explanation

• Remote access VPNs can be used to support the needs of telecommuters and mobile users by allowing them to connect securely to company networks over the Internet. To connect hosts to the VPN server on the corporate network, the remote access VPN tunnel is dynamically built by client software that runs on the hosts.

Two corporations have just completed a merger. The network engineer has been asked to connect the two corporate networks without the expense of leased lines. Which solution would be the most cost effective method of providing a proper and secure connection between the two corporate networks?

• Cisco AnyConnect Secure Mobility Client with SSL

• 
  Cisco Secure Mobility Clientless SSL VPN

• Frame Relay

• remote access VPN using IPsec

• 
  site-to-site VPN

Answer explanation

• The site-to-site VPN is an extension of a classic WAN network that provides a static interconnection of entire networks. Frame Relay would be a better choice than leased lines, but would be more expensive than implementing site-to-site VPNs. The other options refer to remote access VPNs which are better suited for connecting users to the corporate network versus interconnecting two or more networks.

Which two scenarios are examples of remote access VPNs? (Choose two.)

• A toy manufacturer has a permanent VPN connection to one of its parts suppliers.

• All users at a large branch office can access company resources through a single VPN connection.

• A mobile sales agent is connecting to the company network via the Internet connection at a hotel.

• A small branch office with three employees has a Cisco ASA that is used to create a VPN connection to the HQ.

• An employee who is working from home uses VPN client software on a laptop in order to connect to the company network.

Answer explanation

• Remote access VPNs connect individual users to another network via a VPN client that is installed on the user device. Site-to-site VPNs are "always on" connections that use VPN gateways to connect two sites together. Users at each site can access the network on the other site without having to use any special clients or configurations on their individual devices.

Which statement describes the effect of key length in deterring an attacker from hacking through an encryption key?

• The length of a key will not vary between encryption algorithms.

• 
  The length of a key does not affect the degree of security.

• The shorter the key, the harder it is to break.

• 
  The longer the key, the more key possibilities exist.

Answer explanation

• While preventing brute-force attacks and other forced decryption concerns, the longer the key length, the harder it is to break. A 64-bit key can take one year to break with a sophisticated computer, while a 128-bit key may take 10 ¹⁹ years to decrypt. Different encryption algorithms will provide varying key lengths for implementation.

Which statement accurately describes a characteristic of IPsec?

• IPsec works at the application layer and protects all application data.

• 
  IPsec works at the transport layer and protects data at the network layer.

• 
  IPsec is a framework of open standards that relies on existing algorithms.

• 
  IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.

• IPsec is a framework of standards developed by Cisco that relies on OSI algorithms.

Answer explanation

• IPsec can secure a path between two network devices. IPsec can provide the following security functions:
  

  • Confidentiality - IPsec ensures confidentiality by using encryption.

  • Integrity - IPsec ensures that data arrives unchanged at the destination using a hash algorithm, such as MD5 or SHA.

  • Authentication - IPsec uses Internet Key Exchange (IKE) to authenticate users and devices that can carry out communication independently. IKE uses several types of authentication, including username and password, one-time password, biometrics, pre-shared keys (PSKs), and digital certificates.

  • Secure key exchange - IPsec uses the Diffie-Hellman (DH) algorithm to provide a public key exchange method for two peers to establish a shared secret key.

How is "tunneling" accomplished in a VPN?

• 
  New headers from one or more VPN protocols encapsulate the original packets.

• 
  All packets between two hosts are assigned to a single physical medium to ensure that the packets are kept private.

• Packets are disguised to look like other types of traffic so that they will be ignored by potential attackers.

• A dedicated circuit is established between the source and destination devices for the duration of the connection.

Answer explanation

• Packets in a VPN are encapsulated with the headers from one or more VPN protocols before being sent across the third party network. This is referred to as "tunneling". These outer headers can be used to route the packets, authenticate the source, and prevent unauthorized users from reading the contents of the packets.

Which two statements describe the IPsec protocol framework? (Choose two.)

• 
  AH uses IP protocol 51.

• 
  AH provides encryption and integrity.

• 
  AH provides integrity and authentication.

• 
  ESP uses UDP protocol 51.

• 
  AH provides both authentication and encryption.

Answer explanation

• The two primary protocols used with IPsec are AH and ESP. AH is protocol number 51 and provides data authentication and integrity for IP packets that are exchanged between the peers. ESP, which is protocol number 50, performs packet encryption.

What technology is used to negotiate security associations and calculate shared keys for an IPsec VPN tunnel?

• 3DES

• IKE

• PSK

• SHA

Answer explanation

• The Internet Key Exchange (IKE) protocol is a key management protocol standard used when creating an IPsec VPN tunnel. IKE negotiates security associations (SAs) and calculates shared keys.​