Examkin

Question

Difficulty: HardVirtual Private Networks and Remote Access Security

A network administrator is evaluating remote access and tunneling configurations to meet specific enterprise connectivity requirements. Match each secure tunneling protocol or configuration mode on the left with its defining operational characteristic or protocol constraint on the right. Which pairs correctly match each remote access security technology to its technical behavior?

  • IPsec Authentication Header (AH) in Transport ModeComputes an Integrity Check Value (ICV) over the outer IP header, causing session verification to fail if modified by an intervening NAT router.
  • IPsec Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T)Encapsulates encrypted tunnel packets inside UDP port 4500 to allow seamless traversal across Port Address Translation (PAT) devices.
  • Clientless SSL/TLS Portal VPNDelivers access to web applications over standard TCP port 443 without requiring endpoint administrative permissions or local software installation.
  • WireGuard VPN ProtocolOperates natively over UDP port 51820 using state-of-the-art cryptography (such as ChaCha20-Poly1305) with a minimalist Layer 3 codebase.

Answer

IPsec AH in Transport Mode matches with computing an ICV over outer IP headers causing failure across NAT; IPsec ESP with NAT-T matches with encapsulating packets in UDP port 4500 for PAT traversal; Clientless SSL/TLS Portal VPN matches with delivering web application access over TCP 443 without local client software installation; WireGuard VPN matches with operating natively over UDP port 51820 using modern cryptography.
Each protocol match is based on strict operational standards: IPsec AH protects IP header integrity which fails when NAT alters source/destination addresses; NAT-T uses UDP port 4500 to encapsulate ESP traffic through PAT gateways; Clientless SSL/TLS VPN provides web portal access over TCP port 443 via standard web browsers without needing administrative privileges; and WireGuard uses UDP port 51820 along with modern cryptographic primitives for fast Layer 3 tunneling.

Step-by-Step Solution

1
Analyze IPsec AH header integrity hashing mechanism
Identify that AH includes immutable and mutable fields of the IP header in its ICV check, causing NAT modifications to break integrity checks.
AH ensures authentication and anti-replay for the whole packet, making it inherently incompatible with NAT address translation.
2
Evaluate NAT-Traversal (NAT-T) encapsulation behavior
Confirm NAT-T encapsulates ESP packets in UDP port 4500 when NAT is detected during IKE Phase 1 (UDP port 500).
Raw ESP (IP protocol 50) lacks L4 port numbers required for PAT multiplexing, necessitating the UDP port 4500 wrapper.
3
Examine Clientless SSL/TLS VPN architecture
Determine that browser-based portals utilize standard HTTPS over TCP port 443.
Using native browser TLS eliminates the need to install dedicated client agents or hold administrative OS installation rights.
4
Distinguish modern lightweight VPN solutions like WireGuard
Associate WireGuard with its default listening port UDP 51820 and modern cryptographic primitives.
WireGuard runs as a streamlined Layer 3 tunnel protocol designed to replace legacy complex IPsec and OpenVPN setups.

Key Concept

Differentiating VPN Protocol Operations, Layer Encapsulations, and NAT Compatibility
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic