Examkin

Question

Difficulty: Very hardVirtual Private Networks and Remote Access Security

Match each remote access security technology or VPN architectural mechanism on the left to its corresponding operational characteristic and protocol specification on the right.

  • IKEv2 Child Security Association (SA) NegotiationNegotiates specific symmetric encryption keys and traffic selectors for data payload protection using ESP over UDP 500 or UDP 4500.
  • DTLS (Datagram TLS) VPN TunnelingPrevents TCP-over-TCP head-of-line blocking for real-time remote traffic by encapsulating TLS sessions over datagram transport on UDP port 443.
  • GRE over IPsec in Transport ModeEncapsulates multicast routing protocols within a unencrypted tunnel header, which IPsec then encrypts without adding an extra IP header.
  • RADIUS with EAP-TLS Remote AuthenticationEnforces mutual digital-certificate authentication between remote endpoints and an enterprise AAA server over UDP ports 1812/1813.

Answer

IKEv2 Child Security Association (SA) Negotiation pairs with establishing symmetric encryption keys and traffic selectors for ESP payload protection over UDP 500/4500. DTLS VPN Tunneling pairs with preventing TCP-over-TCP head-of-line blocking over UDP 443. GRE over IPsec in Transport Mode pairs with encapsulating dynamic multicast routing protocols without extra IP header overhead. RADIUS with EAP-TLS Remote Authentication pairs with enforcing mutual digital-certificate authentication over UDP ports 1812/1813.
Each technology is correctly aligned with its exact operational specification: IKEv2 Child SA handles Phase 2 payload encryption parameters over UDP 500/4500. DTLS uses UDP 443 to mitigate TCP head-of-line blocking for VPN connections. GRE over IPsec in Transport Mode encapsulates multicast traffic such as dynamic routing without inner/outer IP header duplication. RADIUS with EAP-TLS executes mutual certificate authentication over UDP ports 1812 and 1813.

Step-by-Step Solution

1
Analyze IKEv2 Phase 2 / Child SA mechanics.
Child SAs are established during IKEv2 Phase 2 negotiation to define the specific operational keys, encryption algorithms (e.g., AES-GCM), and security parameters for ESP data traffic over UDP 500/4500.
Differentiates Phase 1 management tunnel setup from Phase 2 data protection SA creation.
2
Analyze DTLS protocol mechanics and transport layer choice.
DTLS uses UDP (port 443) to encapsulate TLS data sessions, resolving the TCP Meltdown / head-of-line blocking problem inherent in encapsulating stateful TCP streams inside standard TLS/TCP tunnels.
Identifies the core performance optimization mechanism of DTLS for real-time remote access VPNs.
3
Analyze GRE over IPsec encapsulated header structure in Transport Mode vs Tunnel Mode.
GRE adds a 4-byte header enabling broadcast/multicast (OSPF/EIGRP) support. Combining GRE with IPsec Transport Mode encrypts the GRE packet directly without duplicating the IP header.
Distinguishes how enterprise site-to-site VPNs handle routing protocols efficiently without double-encapsulation overhead.
4
Analyze RADIUS EAP-TLS remote access AAA workflow.
RADIUS operates on UDP 1812/1813 and passes EAP-TLS payloads to mandate mutual certificate validation for remote endpoints.
Verifies AAA port numbers and strong authentication framework requirements.

Key Concept

Virtual Private Networks and Remote Access Security Mechanisms
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic