Deck 20: Ip Security

Question 1

The __________ mechanism assures that a received packet was in fact transmitted by the party identified as the source in the packet header and assures that the packet has not been altered in transit.

A)confidentiality
B)authentication
C)security
D)key management

Answer 1

D

Question 2

Additional padding may be added to provide partial traffic flow confidentiality by concealing the actual length of the payload.

Answer 2

True

Question 3

__________ provides the capability to secure communications across a LAN,across private and public WANs,and across the Internet.

A)IKE
B)ISA
C)IAB
D)IPsec

Answer 3

C

Question 4

The default automated key management protocol for IPsec is referred to as ISAKMP/Oakley.

Question 5

Both tunnel and transport modes can be accommodated by the encapsulating security payload encryption format.

Question 6

IPsec is executed on a packet-by-packet basis.

Question 7

By implementing security at the IP level an organization can ensure secure networking not only for applications that have security mechanisms but also for the many security ignorant applications.

Question 8

IP security is a capability that can be added to either current version of the Internet Protocol by means of additional headers.

Question 9

The principal feature of IPsec is that it can encrypt and/or authenticate all traffic at the IP level.

Question 10

The _________ facility enables communicating nodes to encrypt messages to prevent eavesdropping by third parties.

A)security
B)key management
C)authentication
D)confidentiality

Question 11

_________ defines a number of techniques for key management.

A)KEP
B)KMP
C)SKE
D)IKE

Question 12

An end user whose system is equipped with IP security protocols can make a local call to an ISP and gain secure access to a company network.

Question 13

Authentication applied to the entire original IP packet is _________ .

A)security mode
B)cipher mode
C)tunnel mode
D)transport mode

Question 14

Any traffic from the local host to a remote host for purposes of an IKE exchange bypasses the IPsec processing.

Question 15

The Security Parameters Index identifies a security association.

Question 16

Authentication must be applied to the entire original IP packet.

Question 17

Transport mode provides protection to the entire IP packet.

Question 18

The Payload Data Field is designed to deter replay attacks.

Question 19

An individual SA can implement both the AH and the ESP protocol.

Question 20

Authentication applied to all of the packet except for the IP header is _________ .

A)tunnel mode
B)transport mode
C)association mode
D)security mode

Question 21

A value chosen by the responder to identify a unique IKE SA is a _________ .

A)Initiator SPI
B)Responder Cookie
C)Flag
D)Message ID

Question 22

IPsec provides security services at the ________ layer by enabling a system to select required security protocols,determine the algorithms to use for the services and put in place any cryptographic keys required to provide the requested services.

Question 23

Confidentiality is provided by an encryption format known as __________ .

Question 24

A __________ attack is one in which an attacker obtains a copy of an authenticated packet and later transmits it to the intended destination.

Question 25

A security association is uniquely identified by three parameters: Security Protocol Identifier,IP Destination Address,and ________ .

Question 26

The means by which IP traffic is related to specific SAs is the _________ .

A)TRS
B)SPD
C)SAD
D)SPI

Question 27

The __________ facility is concerned with the secure exchange of keys.

Question 28

The key management mechanism that is used to distribute keys is coupled to the authentication and privacy mechanisms only by way of the _________ .

A)IAB
B)SPI
C)ESP
D)SPD

Question 29

A _________ is a one way relationship between a sender and a receiver that affords security services to the traffic carried on it.

A)SAD
B)SPD
C)SA
D)SPI

Question 30

_________ consists of an encapsulating header and trailer used to provide encryption or combined encryption/authentication.The current specification is RFC 4303.

A)SPI
B)ESP
C)ISA
D)IPsec

Question 31

The __________ payload contains either error or status information associated with this SA or this SA negotiation.

A)Encrypted
B)Notify
C)Configuration
D)Nonce

Question 32

IPsec encompasses three functional areas: authentication,key management,and __________ .

Question 33

IKE key determination employs __________ to ensure against replay attacks.

A)cookies
B)groups
C)flags
D)nonces

Question 34

IPsec policy is determined primarily by the interaction of two databases: The security policy database and the __________ .

Question 35

The _________ payload allows peers to identify packet flows for processing by IPsec services.

A)Configuration
B)Vendor ID
C)Traffic Selector
D)Extensible Authentication Protocol

Question 36

_________ identifies the type of data contained in the payload data field by identifying the first header in that payload.

A)Security Parameters Index
B)Next Header
C)Sequence Header
D)Payload Data

Question 37

_________ can be used to provide confidentiality,data origin authentication, connectionless integrity,an anti-replay service,and traffic flow confidentiality.

Question 38

_________ mode is used when one or both ends of an SA are a security gateway, such as a firewall or router that implements IPsec.

Question 39

Authentication makes use of the _________ message authentication code.

Question 40

The selectors that determine a Security Policy Database are: Name,Local and Remote Ports,Next Layer Protocol,Remote IP Address,and _________ .

Question 41

The term _________ refers to a sequence of SAs through which traffic must be processed to provide a desired set of IPsec services.

Question 42

Generic in that it does not dictate specific formats,the _________ is a key exchange protocol based on the Diffie-Hellman algorithm with added security.

Question 43

At any point in an IKE exchange the sender may include a _________ payload to request the certificate of the other communicating entity.

Question 44

Three different authentication methods can be used with IKE key determination: Public key encryption,symmetric key encryption,and _________ .