Examkin

Question

Difficulty: HardCryptographic and Security Control Weaknesses

A global pharmaceutical firm connects several remote research facilities to its central datacenters using legacy IPsec VPN site-to-site tunnels. A cryptographic assessment of the gateway configurations reveals that Phase 1 IKE negotiations utilize Diffie-Hellman (DH) Group 2 (1024-bit) with 3DES-CBC payload encryption, while Phase 2 uses MD5 for message integrity verification. Security analysts report elevated risks of session key recovery, collision vulnerabilities, and performance degradation. Which of the following primary mitigation strategies comprehensively addresses these cryptographic control weaknesses?

  1. Reconfigure the IPsec VPN tunnels to use Diffie-Hellman Group 14 or higher (or ECDH), transition payload encryption to AES-256-GCM, and replace MD5 authentication with SHA-256.Answer
  2. B
    Reconfigure the VPN gateway to encrypt all IPsec tunnel payload traffic using RSA-4096 asymmetric encryption rather than symmetric block ciphers.
  3. C
    Deploy a perimeter Web Application Firewall (WAF) inline between the IPsec gateway and the internal network to filter encrypted tunnel traffic.
  4. D
    Reclassify the IPsec VPN concentrators from preventive controls to detective controls and implement daily automated port scans across the tunnel interface.

Answer

Reconfigure the IPsec VPN tunnels to use Diffie-Hellman Group 14 or higher (or ECDH), transition payload encryption to AES-256-GCM, and replace MD5 authentication with SHA-256.
The option recommending upgrading Diffie-Hellman to Group 14 or higher (or ECDH), replacing 3DES with AES-256-GCM, and upgrading MD5 to SHA-256 directly addresses all three identified cryptographic flaws. DH Group 2 (1024-bit) is vulnerable to state-sponsored precomputation; 3DES uses 64-bit blocks subject to collision attacks (Sweet32); and MD5 is broken due to practical hash collisions. Upgrading key length, cipher strength, and hashing algorithms restores robust security across IKE Phase 1 and Phase 2 negotiations.

Step-by-Step Solution

1
Analyze the identified cryptographic weaknesses in the scenario
Identified DH Group 2 (1024-bit MODP) as vulnerable to precomputation attacks, 3DES as vulnerable to Sweet32 collision attacks on 64-bit block sizes, and MD5 as susceptible to cryptographic hash collisions.
Security assessment requires identifying specific failure points across key exchange, bulk encryption, and integrity verification components.
2
Select appropriate modern cryptographic replacements for each vulnerable primitive
Diffie-Hellman Group 14+ / ECDHE replaces weak key exchange, AES-256-GCM replaces weak block ciphers with authenticated encryption, and SHA-256 replaces collision-prone MD5.
CompTIA Security+ standards mandate robust, current symmetric and asymmetric primitives with sufficient key lengths to safeguard enterprise data transit.
3
Evaluate and eliminate incorrect control recommendations
Eliminated options recommending asymmetric ciphers for bulk traffic, network perimeter firewalls for crypto remediation, and control category reclassifications.
Only upgrading the negotiation parameters directly resolves protocol-level cryptographic flaws.

Key Concept

Cryptographic Control Weaknesses and Legacy Cipher Remediation
Rate this question

Topics

Cryptographic and Security Control Weaknesses

More questions from this topic