Examkin

Question

Difficulty: HardVirtual Private Networks and Remote Access Security

A network security team is auditing remote access infrastructure and site-to-site connectivity parameters across an enterprise environment. Match each remote access or tunneling mechanism on the left with its corresponding technical encapsulation and operational characteristic on the right.

  • IPsec Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T)Encapsulates encrypted ESP packets inside UDP port 4500 wrappers to prevent port address translation (PAT) devices from breaking integrity checks.
  • Secure Socket Tunneling Protocol (SSTP)Encapsulates PPP frames directly within an SSL/TLS session over TCP port 443 to bypass restrictive egress firewalls.
  • Generic Routing Encapsulation (GRE) over IPsec Tunnel ModeEncapsulates multicast dynamic routing protocols into unicast packets prior to Layer 3 cryptographic payload encryption.
  • WireGuard ProtocolUtilizes a modern UDP-based cryptokey routing architecture running primarily in kernel space on port 51820.

Answer

IPsec ESP with NAT-T matches encapsulation inside UDP port 4500 to protect integrity checks across PAT devices; SSTP matches encapsulation of PPP frames in SSL/TLS over TCP port 443; GRE over IPsec matches encapsulating multicast routing protocols prior to IPsec encryption; WireGuard matches the modern kernel-space cryptokey routing architecture using UDP port 51820.
Each protocol match correctly aligns the underlying encapsulation mechanism with its target operational requirement: IPsec NAT-T encapsulates ESP in UDP 4500 to survive PAT translation; SSTP packages PPP into SSL/TLS over TCP 443 for firewall traversal; GRE over IPsec enables dynamic routing by wrapping multicast traffic in unicast headers before IPsec encryption; and WireGuard delivers high performance via kernel-space cryptokey routing on UDP 51820.

Step-by-Step Solution

1
Analyze the technical requirements of IPsec NAT-Traversal.
Recognize that NAT-T embeds IPsec ESP (protocol 50) within UDP port 4500 headers so NAT/PAT gateways can translate addresses without corrupting packets or breaking ICV checks.
Standard IPsec ESP lacks Layer 4 port numbers, causing translation failures on NAPT/PAT routers.
2
Analyze firewall traversal mechanisms for remote clients.
Identify SSTP as using TLS over TCP port 443 carrying PPP payloads to masquerade as standard HTTPS web traffic.
Standard HTTPS port 443 is almost universally permitted outward through firewalls and web proxies.
3
Evaluate multi-protocol routing over VPN tunnels.
Connect GRE over IPsec with dynamic routing (multicast) encapsulation capabilities.
IPsec ESP/AH cannot natively encapsulate multicast packets, whereas GRE creates a virtual point-to-point link supporting multicast protocols like OSPF.
4
Evaluate lightweight modern VPN implementations.
Associate WireGuard with its default UDP port 51820 and cryptokey routing model operating in kernel space.
WireGuard avoids complex IKE negotiation overhead by binding static IP addresses directly to public key cryptography configurations.

Key Concept

Encapsulation, port mapping, and operational characteristics of enterprise VPN protocols.
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic