Deck 9: Ip Security

Question 1

An end user whose system is equipped with IP security protocols can make a local call to an ISP and gain secure access to a company network.

Answer 1

True

Question 2

Transport mode provides protection to the entire IP packet.

Answer 2

False

Question 3

The Security Parameters Index identifies a security association.

Answer 3

True

Question 4

The default automated key management protocol for IPsec is referred to as ISAKMP/Oakley.

Question 5

Authentication applied to the entire original IP packet is _________ .

A)security mode
B)cipher mode
C)tunnel mode
D)transport mode

Question 6

The Payload Data Field is designed to deter replay attacks.

Question 7

IPsec is executed on a packet-by-packet basis.

Question 8

IPSec can guarantee that all traffic designated by the network administrator is authenticated but cannot guarantee that it is encrypted.

Question 9

Both tunnel and transport modes can be accommodated by the encapsulating security payload encryption format.

Question 10

The principal feature of IPsec is that it can encrypt and/or authenticate all traffic at the IP level.

Question 11

_________ defines a number of techniques for key management.

A)KEP
B)KMP
C)SKE
D)IKE

Question 12

Authentication must be applied to the entire original IP packet.

Question 13

By implementing security at the IP level an organization can ensure secure networking not only for applications that have security mechanisms but also for the many security ignorant applications.

Question 14

The __________ mechanism assures that a received packet was in fact transmitted by the party identified as the source in the packet header and assures that the packet has not been altered in transit.

A)confidentiality
B)authentication
C)security
D)key management

Question 15

An individual SA can implement both the AH and the ESP protocol.

Question 16

__________ provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet.

A)IKE
B)ISA
C)IAB
D)IPsec

Question 17

Any traffic from the local host to a remote host for purposes of an IKE exchange bypasses the IPsec processing.

Question 18

Additional padding may be added to provide partial traffic flow confidentiality by concealing the actual length of the payload.

Question 19

Authentication applied to all of the packet except for the IP header is _________ .

A)tunnel mode
B)transport mode
C)association mode
D)security mode

Question 20

IP security is a capability that can be added to either current version of the Internet Protocol by means of additional headers.

Question 21

The __________ facility is concerned with the secure exchange of keys.

Question 22

A security association is uniquely identified by three parameters: Security Protocol Identifier, IP Destination Address, and ________ .

Question 23

_________ identifies the type of data contained in the payload data field by identifying the first header in that payload.

A)Security Parameters Index
B)Next Header
C)Sequence Header
D)Payload Data

Question 24

A __________ attack is one in which an attacker obtains a copy of an authenticated packet and later transmits it to the intended destination.

Question 25

A _________ is a one way relationship between a sender and a receiver that affords security services to the traffic carried on it.

A)SAD
B)SPD
C)SA
D)SPI

Question 26

IPsec encompasses three functional areas: authentication, key management, and __________ .

Question 27

The __________ payload contains either error or status information associated with this SA or this SA negotiation.

A)Encrypted
B)Notify
C)Configuration
D)Nonce

Question 28

A value chosen by the responder to identify a unique IKE SA is a _________ .

A)Initiator SPI
B)Responder Cookie
C)Flag
D)Message ID

Question 29

IKE key determination employs __________ to ensure against replay attacks.

A)cookies
B)groups
C)flags
D)nonces

Question 30

Authentication makes use of the _________ message authentication code.

Question 31

The _________ payload allows peers to identify packet flows for processing by IPsec services.

A)Configuration
B)Vendor ID
C)Traffic Selector
D)Extensible Authentication Protocol

Question 32

The key management mechanism that is used to distribute keys is coupled to the authentication and privacy mechanisms only by way of the _________ .

A)IAB
B)SPI
C)ESP
D)SPD

Question 33

IPsec policy is determined primarily by the interaction of two databases: The security policy database and the __________ .

Question 34

IPsec provides security services at the ________ layer by enabling a system to select required security protocols, determine the algorithms to use for the services and put in place any cryptographic keys required to provide the requested services.

Question 35

_________ consists of an encapsulating header and trailer used to provide encryption or combined encryption/authentication.The current specification is RFC 4303.

A)SPI
B)ESP
C)ISA
D)IPsec

Question 36

_________ can be used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service, and traffic flow confidentiality.

Question 37

The means by which IP traffic is related to specific SAs is the _________ .

A)TRS
B)SPD
C)SAD
D)SPI

Question 38

_________ mode is used when one or both ends of an SA are a security gateway, such as a firewall or router that implements IPsec.

Question 39

Confidentiality is provided by an encryption format known as __________ .

Question 40

The _________ facility enables communicating nodes to encrypt messages to prevent eavesdropping by third parties.

A)security
B)key management
C)authentication
D)confidentiality

Question 41

The term _________ refers to a sequence of SAs through which traffic must be processed to provide a desired set of IPsec services.

Question 42

At any point in an IKE exchange the sender may include a _________ payload to request the certificate of the other communicating entity.

Question 43

Three different authentication methods can be used with IKE key determination: Public key encryption, symmetric key encryption, and _________ .

Question 44

The selectors that determine a Security Policy Database are: Name, Local and Remote Ports, Next Layer Protocol, Remote IP Address, and _________ .

Question 45

Generic in that it does not dictate specific formats, the _________ is a key exchange protocol based on the Diffie-Hellman algorithm with added security.