Question

Difficulty: HardRemote Access and Site-to-Site VPN Concepts

Match each Virtual Private Network (VPN) technology or protocol component on the left with its corresponding operational characteristic or security capability on the right.

  • Encapsulating Security Payload (ESP)Provides data confidentiality, integrity, and origin authentication by encrypting the payload.
  • Authentication Header (AH)Provides connectionless integrity and data origin authentication for the entire IP packet, but lacks encryption.
  • Internet Key Exchange Version 2 (IKEv2)Handles mutual authentication and SA negotiation with native support for EAP and NAT Traversal.
  • Clientless SSL/TLS VPNGrants browser-based remote access to web-enabled corporate applications without software installation.

Answer

Encapsulating Security Payload (ESP) matches payload encryption and integrity; Authentication Header (AH) matches unencrypted integrity for the entire IP packet; Internet Key Exchange Version 2 (IKEv2) matches control-plane SA negotiation with EAP/NAT-T support; Clientless SSL/TLS VPN matches web browser portal access to corporate applications without client software.
Each technology is paired with its precise functional domain: ESP delivers encrypted payload security; AH provides unencrypted authentication across the header; IKEv2 negotiates control-plane SAs with EAP and NAT-T capabilities; and Clientless SSL VPN provides browser-restricted access without endpoint software requirements.

Step-by-Step Solution

1
Analyze IPsec Data Plane Protocols
Identify that ESP provides payload encryption and authentication (protocol 50), whereas AH provides packet-wide authentication without encryption (protocol 51).
Differentiating between ESP and AH is fundamental to IPsec security design.
2
Evaluate Key Management Control Plane Protocols
Recognize that IKEv2 negotiates SAs dynamically and includes native improvements over IKEv1, such as EAP integration and reliable NAT-T execution.
IKEv2 manages tunnel setup and identity authentication in modern VPN implementations.
3
Distinguish Remote Access Deployment Models
Match Clientless SSL/TLS VPN to browser-based application access that requires no endpoint client software deployment.
Clientless SSL VPNs operate at the application layer to provide constrained portal access.

Key Concept

IPsec and SSL VPN Protocol Frameworks
Rate this question