Chapter 11 – VPN Concepts
TRUE/FALSE
1. Another name for a VPN connection is tunnel.
2. Hardware VPNs create a gateway-to–gateway VPN.
3. Standards and protocols used in VPNs are in their infancy and seldom used.
4. IPsec has become the standard set of protocols for VPN security.
5. If you use Windows RRAS for your VPN, you will need a third-party RADIUS server if you want to
use RADIUS for authentication.
MULTIPLE CHOICE
1. Which of the following is NOT an essential element of a VPN?
a.
VPN server
c.
VPN client
b.
tunnel
d.
authentication server
2. Which of the following is a type of VPN connection?
a.
site-to-server
c.
server-to-client
b.
client-to-site
d.
remote gateway
3. Which of the following is NOT true about a hardware VPN?
a.
should be the first choice for fast-growing
networks
c.
have more security vulnerabilities than
software VPNs
b.
can handle more traffic than software
VPNs
d.
create a gateway-to–gateway VPN
4. Which of the following is true about software VPNs?
a.
more cost-effective than hardware VPNs
c.
usually less flexible than hardware VPNs
b.
best when all router and firewall hardware
is the same
d.
configuration is easy since there is no OS
to rely upon
5. Which of the following is NOT a factor a secure VPN design should address?
a.
encryption
c.
nonrepudiation
b.
authentication
d.
performance
6. Which of the following is true about using VPNs?
a.
more expensive than leased lines
c.
usually higher performance than leased
lines
b.
can use an existing broadband connection
d.
not dependent on an ISP
7. Which activity performed by VPNs encloses a packet within another packet?
a.
address translation
c.
authentication
b.
encryption
d.
encapsulation
8. Which VPN protocol leverages Web-based applications?
a.
PPTP
c.
SSL
b.
L2TP
d.
IPsec
9. Which VPN protocol is a poor choice for high-performance networks with many hosts due to
vulnerabilities in MS-CHAP?
a.
SSL
c.
IPsec
b.
L2TP
d.
PPTP
10. Which VPN protocol uses UDP port 1701 and does not provide confidentiality and authentication?
a.
IPsec
c.
PPTP
b.
L2TP
d.
SSL
11. Which VPN protocol works at Layer 3 and can encrypt the entire TCP/IP packet?
a.
PPTP
c.
IPsec
b.
L2TP
d.
SSL
12. Which of the following is defined as a relationship between two or more entities that describes how
they will use the security services to communicate?
a.
pairing
c.
internet key exchange
b.
security association
d.
tunnel
13. Which IPsec component is software that handles the tasks of encrypting, authenticating,
decrypting, and checking packets?
a.
ISAKMP
c.
IPsec driver
b.
IKE
d.
Oakley protocol
14. Which IPsec component authenticates TCP/IP packets to ensure data integrity?
a.
AH
c.
IKE
b.
ESP
d.
ISAKMP
15. What are the two modes in which IPsec can be configured to run?
a.
transit and gateway
c.
header and payload
b.
client and server
d.
tunnel and transport
16. Which of the following is true about SSL?
a.
it uses shared-key encryption only
c.
it operates at the Data Link layer
b.
it uses sockets to communicate between
client and server
d.
it uses IPsec to provide authentication
17. Which of the following is an improvement of TLS over SSL?
a.
requires less processing power
c.
uses only asymmetric encryption
b.
uses a single hashing algorithm for all the
data
d.
adds a hashed message authentication
code
18. Which VPN topology is also known as a hub-and-spoke configuration?
a.
bus
c.
star
b.
partial mesh
d.
full mesh
19. Which of the following is a disadvantage of putting the VPN on a firewall?
a.
centralized control of network access
security
c.
VPN and firewall use the same
configuration tools
b.
more configuration mistakes
d.
Internet and VPN traffic compete for
resources
20. What was created to address the problem of remote clients not meeting an organization’s VPN security
standards?
a.
split tunneling
c.
IPsec filters
b.
VPN quarantine
d.
GRE isolation
COMPLETION
1. Network gateways are ____________ of the VPN connection.
2. _________________ based VPNs are appropriate when the endpoints are controlled by different
organizations and network administrators.
3. The Internet Key ______________ protocol enables computers to make an SA.
4. While the AH ensures data integrity, confidentiality of data is provided by the __________ component
of IPsec.
5. TLS splits the input data in half and recombines it using a(n) ___________ function.
MATCHING
a.
AH
f.
ISAKMP
b.
ESP
g.
Kerberos
c.
GRE
h.
KDC
d.
IKE
i.
SSL
e.
IPsec
j.
TGT
1. an IPsec-related protocol that enables two computers to agree on security settings and establish a
Security Association so that they can use Internet Key Exchange
2. an IPsec protocol that provides authentication of TCP/IP packets to ensure data integrity
3. a form of key exchange used to encrypt and decrypt data as it passes through a VPN tunnel
4. a digital token sent from the Authentication Server to the client
5. an IETF standard for secure authentication of requests for resource access
6. an IPsec protocol that encrypts the header and data components of TCP/IP packets
7. a protocol developed by Netscape Communications Corporation as a way of enabling Web servers and
browsers to exchange encrypted information
8. a set of standard procedures that the IETF developed for enabling secure communication on the
Internet
9. Kerberos component that holds secret keys for users, applications, services, or resources
10. a nonproprietary tunneling protocol that can encapsulate a variety of Network layer protocols
SHORT ANSWER
1. Define virtual private network.
2. List four standard VPN protocols.
3. List two advantages and two disadvantages of VPNs.
4. Briefly describe the L2TP protocol.
5. List two reasons IPsec has become the standard set of protocols for VPN security.
6. What four events occur when one IPsec-compliant computer connects to another?
7. What is AES and why is AES a better encryption method to use compared to DES?
8. How is authentication implemented in a VPN?
9. What is an advantage of Kerberos authentication with respect to password security? Explain.
10. Describe a mesh VPN topology. What are advantages and disadvantages?