Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

Match each Virtual Private Network (VPN) protocol or header component to its corresponding operational characteristics and transport specifications.

  • WireGuardHigh-performance, lightweight protocol operating in kernel space that defaults to UDP port 51820 and uses ChaCha20-Poly1305 cryptography.
  • SSTP (Secure Socket Tunneling Protocol)Encapsulates PPP frames within SSL/TLS over TCP port 443, making it ideal for traversing restrictive firewalls.
  • IPsec AH (Authentication Header)Provides data origin authentication and connection integrity at OSI Layer 3 via IP protocol 51, but lacks payload encryption and breaks when passing through NAT.
  • L2TP (Layer 2 Tunneling Protocol)Operates at OSI Layer 2 using UDP port 1701 for encapsulation, requiring a complementary security suite to provide data confidentiality.

Answer

WireGuard pairs with high-performance kernel-space UDP port 51820 execution; SSTP pairs with SSL/TLS encapsulation over TCP port 443; IPsec AH pairs with OSI Layer 3 IP protocol 51 authentication without encryption; L2TP pairs with OSI Layer 2 tunneling over UDP port 1701 requiring secondary encryption.
Each VPN technology fulfills a specific niche: WireGuard provides fast kernel-level VPN connectivity on UDP port 51820; SSTP leverages TLS over TCP port 443 to circumvent restrictive firewalls; IPsec AH secures packet headers at Layer 3 using IP protocol 51 without encrypting data; and L2TP establishes Layer 2 tunnels on UDP port 1701 that rely on external protocols like IPsec for payload encryption.

Step-by-Step Solution

1
Analyze WireGuard characteristics
WireGuard is recognized by its lightweight design, Linux kernel integration, modern ChaCha20-Poly1305 cipher suite, and default listening port on UDP 51820.
Differentiates modern state-of-the-art tunnel protocols from legacy PPP-based options.
2
Analyze SSTP transport features
SSTP uses TCP port 443 to tunnel PPP sessions inside TLS encryption.
Allows traffic to masquerade as standard HTTPS traffic to bypass firewall restrictions.
3
Differentiate IPsec Authentication Header (AH) from Encapsulating Security Payload (ESP)
AH uses IP protocol 51 for integrity and anti-replay protection without encrypting payload data, causing NAT verification failures due to header modification.
Identifies protocol-level security boundaries and NAT incompatibility issues.
4
Identify L2TP operational layer and security requirements
L2TP functions at Layer 2 to encapsulate PPP frames across IP networks over UDP port 1701, but requires IPsec for payload confidentiality.
Distinguishes pure tunneling mechanisms from integrated cryptographic VPN frameworks.

Key Concept

Distinguishing Virtual Private Network (VPN) and remote access protocols based on OSI layer operation, port numbers, encapsulation methods, and cryptographic capabilities.
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic