Which Technique Is Necessary To Ensure A Private Transfer Of Data Using A Vpn?

CCNA Security v2.0 Affiliate 8 Answers – Implementing Network Security

Concluding updated Feb 18, 2019

CCNA Security Chapter eight Test Answers

Which transform set provides the best protection?
- crypto ipsec transform-prepare ESP-DES-SHA esp-aes-256 esp-sha-hmac*
- crypto ipsec transform-set ESP-DES-SHA esp-3des esp-sha-hmac
- crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
- crypto ipsec transform-set ESP-DES-SHA esp-aes esp-des esp-sha-hmac
DES uses 56-scrap keys. 3DES uses 56-bit keys, but encrypts 3 times. AES uses 128-bit keys. AES-256 uses 256-scrap keys and is the strongest.
Which three ports must be open to verify that an IPsec VPN tunnel is operating properly? (Choose three.)
- 168
- 50*
- 169
- 501
- 500*
- 51*
Refer to the showroom. How volition traffic that does not match that defined past access list 101 be treated by the router?
- Information technology will be sent unencrypted.*
- It will exist sent encrypted.
- It will be blocked.
- It will be discarded.
The admission listing 101 is role of the crypto map configuration on the router. The purpose of the admission listing is to place interesting traffic that should be sent encrypted over a VPN. Traffic that does not match the admission-listing is not interesting and is not sent encrypted but rather sent unencrypted in plain text.
What three protocols must be permitted through the company firewall for institution of IPsec site-to-site VPNs? (Choose three.)
- HTTPS
- SSH
- AH*
- ISAKMP*
- NTP
- ESP*
ESP, AH, and ISAKMP must all be permitted through the perimeter routers and firewalls in gild for IPsec site-to-site VPNs to be established. NTP and HTTPS are application protocols and are not required for IPsec.
When is a security clan (SA) created if an IPsec VPN tunnel is used to connect between two sites?
- after the tunnel is created, but before traffic is sent
- only during Phase 2
- merely during Stage 1
- during both Stage 1 and 2*
Equally seen in the 8.4.1.1 Figure, an IPsec VPN connexion creates 2 SAs: (ane) at the completion of the IKE Phase 1 once the peers negotiate the IKE SA policy, and (2) at the end of IKE Phase 2 after the transform sets are negotiated.
In which state of affairs would the Cisco Discovery Protocol exist disabled?
- when a Cisco VoIP telephone attaches to a Cisco switch
- when a Cisco switch connects to another Cisco switch
- when a Cisco switch connects to a Cisco router
- when a PC with Cisco IP Communicator installed connects to a Cisco switch*
Cisco Discovery Protocol should be disabled on ports that do not connect to other Cisco devices. Fifty-fifty though the PC has a Cisco software product installed, the port to which the PC connects should have Cisco Discovery Protocol disabled because of the network data that can be derived from capturing Cisco Discovery Protocol letters.
Which 2 statements accurately describe characteristics of IPsec? (Choose two.)
- IPsec works at the transport layer and protects information at the network layer.
- IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.
- IPsec is a framework of standards developed by Cisco that relies on OSI algorithms.
- IPsec is a framework of open standards that relies on existing algorithms.*
- IPsec works at the network layer and operates over all Layer 2 protocols.*
- IPsec works at the application layer and protects all application data.
IPsec tin secure a path between two network devices. IPsec tin provide the following security functions:
Confidentiality – IPsec ensures confidentiality past using encryption.
Integrity – IPsec ensures that data arrives unchanged at the destination using a hash algorithm, such as MD5 or SHA.
Authentication – IPsec uses Cyberspace Key Exchange (IKE) to authenticate users and devices that can carry out advice independently. IKE uses several types of authentication, including username and countersign, one-time password, biometrics, pre-shared keys (PSKs), and digital certificates.
Secure primal substitution – IPsec uses the Diffie-Hellman (DH) algorithm to provide a public key exchange method for two peers to establish a shared underground key.
Which activity do IPsec peers take during the IKE Phase 2 commutation?
- exchange of DH keys
- negotiation of IPsec policy*
- negotiation of IKE policy sets
- verification of peer identity
The IKE protocol executes in two phases. During Stage i the two sides negotiate IKE policy sets, authenticate each other, and set up a secure channel. During the second phase IKE negotiates security associations between the peers.
Which argument describes the upshot of key length in deterring an attacker from hacking through an encryption cardinal?
- The length of a cardinal does non affect the degree of security.
- The shorter the key, the harder it is to pause.
- The length of a cardinal will not vary between encryption algorithms.
- The longer the central, the more central possibilities exist.*
While preventing brute-strength attacks and other forced decryption concerns, the longer the key length, the harder information technology is to intermission. A 64-bit key tin can accept one twelvemonth to break with a sophisticated calculator, while a 128-bit key may have 1019 years to decrypt. Unlike encryption algorithms will provide varying fundamental lengths for implementation.
What is the purpose of configuring multiple crypto ACLs when building a VPN connection between remote sites?
- By applying the ACL on a public interface, multiple crypto ACLs tin can be built to forbid public users from connecting to the VPN-enabled router.
- Multiple crypto ACLs can define multiple remote peers for connecting with a VPN-enabled router beyond the Internet or network.
- Multiple crypto ACLs tin can be configured to deny specific network traffic from crossing a VPN.
- When multiple combinations of IPsec protection are being called, multiple crypto ACLs can ascertain dissimilar traffic types.*
A crypto ACL tin can define "interesting traffic" that is used to build a VPN, and forwards that "interesting traffic" across the VPN to some other VPN-enabled router. Multiple crypto ACLs are used to define multiple unlike types of traffic and utilize different IPsec protection corresponding to the different types of traffic.
Consider the following configuration on a Cisco ASA:
crypto ipsec transform-fix ESP-DES-SHA esp-des esp-sha-hmac
What is the purpose of this command?
- to ascertain the ISAKMP parameters that are used to constitute the tunnel
- to define the encryption and integrity algorithms that are used to build the IPsec tunnel*
- to define what traffic is immune through and protected by the tunnel
- to define just the allowed encryption algorithms
The transform set is negotiated during Phase 2 of the IPsec VPN connectedness procedure. The purpose of the transform set is to define what encryption and authentication schemes can be used. The device doing the VPN initiation offers the acceptable transform sets in society of preference, in this case, ESP authentication using DES for encryption or ESP authentication using SHA-HMAC authentication and integrity for the data payload. Remember that ESP provides confidentiality with encryption and integrity with authentication. The ESP-DES-SHA is the proper name of the transform set. The parameters that follow (esp-des and esp-sha-hmac) are the specific types of encryption or authentication that is supported by the ASA for the VPN tunnel that uses this transform set.
Which technique is necessary to ensure a individual transfer of data using a VPN?
- encryption*
- authorization
- virtualization
- scalability
Confidential and secure transfers of information with VPNs require data encryption.
Which statement describes a VPN?
- VPNs utilise open source virtualization software to create the tunnel through the Cyberspace.
- VPNs use virtual connections to create a individual network through a public network.*
- VPNs use defended concrete connections to transfer data between remote users.
- VPNs utilize logical connections to create public networks through the Internet.
Which protocol provides authentication, integrity, and confidentiality services and is a type of VPN?
- ESP
- IPsec*
- MD5
- AES
IPsec services allow for hallmark, integrity, access control, and confidentiality. With IPsec, the information exchanged between remote sites tin be encrypted and verified. Both remote-access and site-to-site VPNs can be deployed using IPsec.
Which three statements describe the IPsec protocol framework? (Cull three.)
- AH provides integrity and hallmark.*
- ESP provides encryption, authentication, and integrity.*
- AH uses IP protocol 51.*
- AH provides encryption and integrity.
- ESP uses UDP protocol fifty.
- ESP requires both hallmark and encryption.
The ii chief protocols used with IPsec are AH and ESP. AH is protocol number 51 and provides data authentication and integrity for IP packets that are exchanged between the peers. ESP, which is protocol number 50, performs bundle encryption.
Which statement accurately describes a feature of IPsec?
- IPsec works at the application layer and protects all application data.
- IPsec is a framework of standards developed past Cisco that relies on OSI algorithms.
- IPsec is a framework of proprietary standards that depend on Cisco specific algorithms.
- IPsec works at the transport layer and protects information at the network layer.
- IPsec is a framework of open standards that relies on existing algorithms.*
IPsec tin can secure a path between two network devices. IPsec can provide the following security functions:
Confidentiality – IPsec ensures confidentiality by using encryption.
Integrity – IPsec ensures that data arrives unchanged at the destination using a hash algorithm, such equally MD5 or SHA.
Authentication – IPsec uses Internet Cardinal Exchange (IKE) to authenticate users and devices that can carry out communication independently. IKE uses several types of authentication, including username and password, one-fourth dimension countersign, biometrics, pre-shared keys (PSKs), and digital certificates.
Secure key commutation- IPsec uses the Diffie-Hellman (DH) algorithm to provide a public primal exchange method for two peers to establish a shared secret primal.
Which two IPsec protocols are used to provide data integrity?
- SHA*
- AES
- DH
- MD5*
- RSA
The IPsec framework uses various protocols and algorithms to provide information confidentiality, information integrity, authentication, and secure key exchange. Two pop algorithms used to ensure that data is not intercepted and modified (data integrity) are MD5 and SHA. AES is an encryption protocol and provides data confidentiality. DH (Diffie-Hellman) is an algorithm used for key exchange. RSA is an algorithm used for authentication.
What is the office of the Diffie-Hellman algorithm inside the IPsec framework?
- provides hallmark
- allows peers to exchange shared keys*
- guarantees message integrity
- provides strong information encryption
The IPsec framework uses various protocols and algorithms to provide data confidentiality, data integrity, authentication, and secure cardinal exchange. DH (Diffie-Hellman) is an algorithm used for key commutation. DH is a public primal exchange method that allows 2 IPsec peers to establish a shared secret key over an insecure aqueduct.
Refer to the exhibit. What HMAC algorithm is being used to provide data integrity?
- MD5
- AES
- SHA*
- DH
Two popular algorithms that are used to ensure that data is not intercepted and modified (data integrity) are MD5 and SHA. The command Router1(config-isakmp)# hash sha indicates that SHA is existence used. AES is an encryption protocol and provides data confidentiality. DH (Diffie-Hellman) is an algorithm that is used for cardinal exchange. RSA is an algorithm used for authentication.
What is needed to define interesting traffic in the creation of an IPsec tunnel?
- security associations
- hashing algorithm
- access list*
- transform set
In lodge to bring up an IPsec tunnel, an access list must be configured with a permit statement that volition identify interesting traffic. Once interesting traffic is detected by matching the access listing, the tunnel security associations can be negotiated.
Refer to the exhibit. What algorithm will be used for providing confidentiality?
- RSA
- Diffie-Hellman
- DES
- AES*
The IPsec framework uses various protocols and algorithms to provide data confidentiality, information integrity, hallmark, and secure primal exchange. 2 popular algorithms that are used to ensure that data is not intercepted and modified (data integrity) are MD5 and SHA. AES is an encryption protocol and provides information confidentiality. DH (Diffie-Hellman) is an algorithm that is used for fundamental commutation. RSA is an algorithm used for authentication.
Which two protocols must exist allowed for an IPsec VPN tunnel is operate properly? (Choose 2.)
- 501
- 500
- 51*
- 168
- 50*
- 169
ESP uses protocol 50. AH uses protocol 51. ISAKMP uses UDP port 500.
What is the purpose of NAT-T?
- enables NAT for PC-based VPN clients
- permits VPN to work when NAT is beingness used on i or both ends of the VPN*
- upgrades NAT for IPv4
- allows NAT to be used for IPv6 addresses
Establishing a VPN between ii sites has been a challenge when NAT is involved at either terminate of the tunnel. The enhanced version of original IKE, IKE version 2, now supports NAT-T. NAT-T has the ability to encapsulate ESP packets inside UDP and then that the VPN tunnel can be established through a device that has NAT enabled.
Which term describes a state of affairs where VPN traffic that is is received by an interface is routed back out that same interface?
- GRE
- split tunneling
- MPLS
- hairpinning*
Hairpinning allows VPN traffic that is received on a single interface to be routed back out that same interface. Separate tunneling allows traffic that originates from a remote-access client to exist split according to traffic that must cantankerous a VPN and traffic destined for the public Net. MPLS and GRE are 2 types of Layer 3 VPNs.
What is an important characteristic of remote-access VPNs?
- The VPN configuration is identical betwixt the remote devices.
- Internal hosts take no cognition of the VPN.
- Information required to establish the VPN must remain static.
- The VPN connection is initiated by the remote user.*
With remote-access VPNs, the remote user does not necessarily take the VPN connection gear up at all times. The remote user PC is responsible for initiating the VPN. Information required to establish the VPN connection changes dynamically depending on the location of the user when attempting to connect.
Which type of site-to-site VPN uses trusted group members to eliminate indicate-to-signal IPsec tunnels between the members of a group?
- DMVPN
- GRE
- GETVPN*
- MPLS
Group Encrypted Send VPN (GETVPN) uses a trusted group to eliminate point-to-point tunnels and their associated overlay routing. GETVPN is ofttimes described as "tunnel-less." Dynamic Multipoint VPN (DMVPN) enables auto-provisioning of site-to-site IPsec VPNs using a combination of three Cisco IOS features: NHRP, GRE, and IPsec VPNs. Generic Routing Encapsulation (GRE) is a tunneling protocol developed by Cisco that encapsulates multiprotocol traffic between remote Cisco routers, but does not encrypt data. An MPLS VPN consists of a gear up of sites that are interconnected by ways of an MPLS provider core network.
Refer to the exhibit. Which pair of crypto isakmp key commands would correctly configure PSK on the 2 routers?
- R1(config)# crypto isakmp cardinal cisco123 address 209.165.200.227
  R2(config)# crypto isakmp key cisco123 address 209.165.200.226*
- R1(config)# crypto isakmp key cisco123 address 209.165.200.226
  R2(config)# crypto isakmp cardinal cisco123 address 209.165.200.227
- R1(config)# crypto isakmp key cisco123 hostname R1
  R2(config)# crypto isakmp key cisco123 hostname R2
- R1(config)# crypto isakmp fundamental cisco123 accost 209.165.200.226
  R2(config)# crypto isakmp key secure address 209.165.200.227
The correct syntax of the crypto isakmp central command is as follows:
crypto isakmp key keystring address peer-address
or
crypto isakmp keykeystring hostname peer-hostnameSo, the correct answer would be the following:
R1(config)# crypto isakmp fundamental cisco123 accost 209.165.200.227
R2(config)# crypto isakmp key cisco123 address 209.165.200.226