Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

A network administrator is deploying a dual-protocol Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec) remote access VPN for mobile employees, integrated with a central RADIUS server for enterprise AAA. Which of the following technical requirements and protocol characteristics are accurate for this implementation? (Select TWO.)

  1. L2TP provides data tunneling and frame encapsulation, while IPsec provides data confidentiality and payload integrity.Answer
  2. The initial connection setup relies on UDP port 500 for IPsec IKE negotiation and UDP port 1701 for L2TP session traffic.Answer
  3. C
    L2TP natively encrypts user data frames at the OSI Data Link layer before forwarding packets to IPsec for network routing.
  4. D
    The remote client software opens a direct TCP port 1812 encrypted session with the RADIUS server for pre-tunnel authentication.

Answer

L2TP provides data tunneling and frame encapsulation while IPsec provides data confidentiality and integrity, and the initial connection setup relies on UDP port 500 for IPsec IKE negotiation and UDP port 1701 for L2TP session traffic.
L2TP/IPsec combines the tunneling capabilities of L2TP with the security features of IPsec. L2TP encapsulates Layer 2 frames inside UDP packets, while IPsec provides encryption (ESP) and security association negotiation (IKE over UDP 500). L2TP session management uses UDP port 1701.

Step-by-Step Solution

1
Analyze the functional responsibilities of L2TP and IPsec in a combined deployment.
Identify that L2TP handles Layer 2 frame tunneling and user session control, but lacks encryption capabilities. IPsec fills this gap by encrypting and authenticating the encapsulated L2TP packets at Layer 3.
Understanding layer separation in composite VPN protocols clarifies why both L2TP and IPsec are paired together.
2
Verify transport layer protocols and port numbers associated with L2TP/IPsec operations.
Confirm that IPsec Internet Key Exchange (IKE) uses UDP port 500 for phase negotiations, while L2TP uses UDP port 1701 for tunnel maintenance and control.
Firewall configuration rules for remote access VPNs require precise identification of both protocol control ports.
3
Evaluate and eliminate distractors related to encryption layers and RADIUS client-server architecture.
Disprove native L2TP encryption (Layer 2) and direct client-to-RADIUS TCP communication, recognizing RADIUS uses UDP (ports 1812/1813) and operates between the VPN gateway and RADIUS server.
Prevents common misconceptions regarding AAA query transport and VPN client authentication flows.

Key Concept

L2TP/IPsec Architecture, OSI Encapsulation, and Port Requirements
Estimated Time:1m 30s
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic