Deck 20: Ip Security

Question 1

IPSec can guarantee that all traffic designated by the network
administrator is authenticated but cannot guarantee that it is
encrypted.

Answer 1

False

Question 2

the __________ mechanism assures that a received packet was in fact transmitted by the party identified as the source in the packet header and assures that the
Packet has not been altered in transit.

A) confidentiality
B) authentication
C) security
D) key management

Answer 2

D

Question 3

Additional padding may be added to provide partial traffic-flow
confidentiality by concealing the actual length of the payload.

Answer 3

True

Question 4

the _________ facility enables communicating nodes to encrypt messages to prevent eavesdropping by third parties.

A) security
B) key management
C) authentication
D) confidentiality

Question 5

An end user whose system is equipped with IP security protocols
can make a local call to an ISP and gain secure access to a company
network.

Question 6

the Payload Data Field is designed to deter replay attacks.
14.the Security Parameters Index identifies a security association.

Question 7

the default automated key management protocol for IPsec is
referred to as ISAKMP/Oakley.

Question 8

Any traffic from the local host to a remote host for purposes of an
IKE exchange bypasses the IPsec processing.

Question 9

__________ provides the capability to secure communications across a LAN, across private and public WANs, and across the Internet.

A) IKE
B) ISA
C) IAB
D) IPsec

Question 10

transport mode provides protection to the entire IP packet.

Question 11

the principal feature of IPsec is that it can encrypt and/or
authenticate all traffic at the IP level.

Question 12

transport adjacency refers to applying more than one security
protocol to the same IP packet without invoking tunneling.

Question 13

IPsec is executed on a packet-by-packet basis.

Question 14

Authentication must be applied to the entire original IP packet.

Question 15

An individual SA can implement both the AH and the ESP protocol.

Question 16

By implementing security at the IP level, an organization can
ensure secure networking not only for applications that have security mechanisms but also for the many security-ignorant applications.

Question 17

Authentication applied to the entire original IP packet is _________ .

A) security mode
B) cipher mode
C) tunnel mode
D) transport mode

Question 18

_________ key determination is a refinement of the Diffie-Hellman key exchange algorithm.

A) KEP
B) KMP
C) SKE
D) IKE

Question 19

Authentication applied to all of the packet except for the IP header is _________ .

A) tunnel mode
B) transport mode
C) association mode
D) security mode

Question 20

Both tunnel and transport modes can be accommodated by the
encapsulating security payload encryption format.

Question 21

_________ can be used to provide access control, confidentiality, data origin
authentication, connectionless integrity, rejection of replayed packets, and limited traffic flow confidentiality.

Question 22

A value chosen by the responder to identify a unique IKE SA is a _________ .

A) Initiator SPI
B) Responder SPI
C) Flag
D) Message identifier

Question 23

_________ mode is used when one or both ends of an SA are a security gateway,
such as a firewall or router that implements IPsec.

Question 24

the __________ payload contains either error or status information associated with this SA or this SA negotiation.

A) Encrypted
B) Notify
C) Configuration
D) Nonce

Question 25

IKE key determination employs __________ to ensure against replay attacks.

A) cookies
B) groups
C) flags
D) nonces

Question 26

the __________ facility is concerned with the secure exchange of keys.

Question 27

A security association is uniquely identified by three parameters: Security
Protocol Identifier, IP Destination Address, and ________ .

Question 28

the _________ payload allows IKE SAs to be authenticated using EAP.

A) Configuration
B) Vendor ID
C) Traffic Selector
D) Extensible Authentication Protocol

Question 29

A _________ is a one way relationship between a sender and a receiver that affords security services to the traffic carried on it.

A) SAD
B) SPD
C) SA
D) SPI

Question 30

the __________ exchange requires that each side send a pseudorandom number in
the initial message, which the other side acknowledges.

Question 31

__________ can be used to secure communication with other organizations,
ensuring authentication and confidentiality and providing a key exchange mechanism.

Question 32

_________ identifies the type of data contained in the payload data field by identifying the first header in that payload.

A) Security Parameters Index
B) Next Header
C) Sequence Header
D) Payload Data

Question 33

IPsec provides security services at the ________ layer by enabling a system to
select required security protocols, determine the algorithms to use for the
services and put in place any cryptographic keys required to provide the
requested services.

Question 34

IPsec policy is determined primarily by the interaction of two databases: the
security policy database and the __________ .

Question 35

A __________ attack is one in which an attacker obtains a copy of an authenticated
packet and later transmits it to the intended destination.

Question 36

the means by which IP traffic is related to specific SAs is the _________ .

A) TRS
B) SPD
C) SAD
D) SPI

Question 37

the key management mechanism that is used to distribute keys is coupled to the authentication and privacy mechanisms only by way of the _________ .

A) IAB
B) SPI
C) ESP
D) SPD

Question 38

Confidentiality is a service provided by an encryption format known as __________ .

Question 39

IPsec encompasses three functional areas: authentication, key management, and
__________ .

Question 40

_________ consists of an encapsulating header and trailer used to provide encryption or combined encryption/authentication.the current specification is
RFC 4303.

A) SPI
B) ESP
C) ISA
D) IPsec

Question 41

the term _________ refers to a sequence of SAs through which traffic must be
processed to provide a desired set of IPsec services.

Question 42

Generic in that it does not dictate specific formats, the _________ is a key exchange
protocol based on the Diffie-Hellman algorithm with added security.

Question 43

three different authentication methods can be used with IKE key determination:
Public key encryption, symmetric key encryption, and _________ .

Question 44

At any point in an IKE exchange the sender may include a _________ payload to
request the certificate of the other communicating entity.