Cryptography, VPNs, and Cryptographic Services

Which cryptographic service ensures that data has not been altered in transit or storage?

In cryptography, what is achieved by using encryption algorithms?

What is the primary difference between symmetric and asymmetric encryption?

Which of the following is a characteristic of a good hash function?

How does a Certificate Authority (CA) contribute to the authentication process in asymmetric key cryptography?

Which of the following algorithms is considered a symmetric encryption algorithm?

What is the purpose of a digital signature?

Which of the following is a key exchange algorithm?

In the context of cryptography, what does non-repudiation ensure?

Which of the following is a characteristic of Public Key Infrastructure (PKI)?

How does hashing contribute to data integrity?

Which of the following is a primary goal of key management in cryptography?

What is the role of a Registration Authority (RA) in the PKI framework?

Which cryptographic service is primarily achieved through the use of Hashed Message Authentication Codes (HMAC)?

Why is the length of the key a crucial factor in cryptographic algorithms?

Which of the following accurately describes a man-in-the-middle attack?

Which of these choices describes the purpose of 'salting' in the context of password hashing?

What is the primary reason for using both symmetric and asymmetric encryption in protocols like SSL/TLS?

Which of the following is most vulnerable to frequency analysis?

Which of the following is an advantage of asymmetric encryption compared to symmetric encryption?

What are the properties of a digital signature?

What are the advantages of using symmetric algorithms?

If Alice wants to send an encrypted message to Bob using public-key cryptography, what key does Alice use to encrypt the message?

How would you best mitigate against replay attacks?

Which of the following is an important part of a PKI framework?

Encryption provides the cryptographic service of ensuring data confidentiality.

The primary goal of integrity services is to prevent unauthorized modification of information, ensuring that data remains consistent and trustworthy.

A hash algorithm is reversible, meaning the original data can be recovered from the hash value.

In symmetric encryption, the encryption and decryption keys are different, while in asymmetric encryption, they are the same.

The MD5 algorithm generates a hash value of 256 bits, providing a stronger level of security compared to SHA-1.

In the context of digital signatures, the private key is used to verify the signature, while the public key is used to create the signature.

Adding a secret key to a hash function, as done in HMAC, enhances authenticity of the message.

Digital signatures cannot be reused for different documents because they are uniquely tied to the signed data.

A digital certificate can be self-signed and still be considered valid and trusted by other parties.

The main purpose of a Certificate Authority (CA) is to issue and verify digital certificates, establishing trust in online transactions.

Authentication is the process of ensuring that data has not been altered in transit, focusing on the integrity of the information.

The Diffie-Hellman key exchange allows two parties to establish a shared secret key over an unsecure channel, even if an eavesdropper is present.

The initialism CIA in cryptography refers to Certification, Integrity, and Availability.

Using a longer key length in symmetric encryption (e.g., AES 256-bit instead of 128-bit) generally decreases the computational complexity and thus encryption time.

The main goal of cryptography is to provide absolute and unbreakable security, preventing any possibility of data breaches or unauthorized access.

In asymmetric encryption, the public key is kept secret by the owner, while the private key is distributed to anyone who needs to send encrypted messages.

The main advantage of symmetric encryption over asymmetric encryption is its enhanced scalability, especially in scenarios with many communicating parties.

The 'salt' used in hashing passwords should be a publicly known constant value to ensure consistency across different systems.

SHA-256 produces a hash value of 128 bits.

Using peer authentication methods, RSA is considered to be more secure than PSK.

The integrity of a message is assured by using encryption.

In PKI, the Registration Authority directly issues the digital certificates.

A digital signature proves the sender's identity and is able to also encrypt the message.

If two different sets of data produce the same hash value, this is known as a collision.

Public Key Infrastructure (PKI) is designed to issue public keys, but not used for issuing private keys.

Which VPN benefit primarily addresses the ability to support a growing number of connections and remote sites without significant infrastructure overhaul?

In a site-to-site VPN, how does a client typically interact with the VPN?

When comparing Authentication Header (AH) and Encapsulating Security Payload (ESP) in IPsec, what key difference affects their deployment?

Why is the Internet Key Exchange (IKE) protocol essential for IPsec VPNs?

Which hash algorithm are suitable for ensuring integrity, offering varying levels of security and performance?

During IKE Phase 1 negotiation, what is the primary goal?

In the context of cryptography and VPNs, what does a transform set define?

What is the purpose of configuring an Access Control List (ACL) when setting up an IPsec VPN?

What command is required to enable ISAKMP?

After configuring an IPsec VPN, which of the following actions is essential to verify its operation?

How do Remote Access VPNs and Site-to-Site VPNs primarily differ in their application?

If a network administrator needs to configure a VPN that must support both authentication and encryption, which IPsec protocol should they choose?

Which command is used to configure the hash algorithm?

Before encapsulating and authenticating traffic across the VPN tunnel what must be configured?

What benefit do VPNs provide when connecting to branch offices?

What is one of the benefits of IPsec tunnel mode?

A network admin is configuring IPsec. Which task must he or she configure first?

What is a common step in troubleshooting IPsec VPN connectivity issues?

Where can you configure the peer address in ISAKMP?

What is the lifetime of the security association seconds?

If a technician configured both sides of the IPsec VPN tunnel, what is the next step?

What command is used to show crypto keys?

What does implementing Perfect Forward Secrecy (PFS) do for the VPN tunnel?

What are the benefits of VPNs?

Which ACL command permits ESP traffic for an IPsec tunnel?

VPNs can offer cost savings by reducing the need for dedicated, expensive WAN connections.

All VPNs provide only encryption, and do not offer authentication or data integrity features.

Scalability is a benefit of VPNs, allowing organizations to easily add or remove connections as needed.

A site-to-site VPN is typically used to allow individual users to connect securely to a central network from remote locations.

Remote-access VPNs do not require the installation of VPN client software on the user's device.

In a site-to-site VPN, the client device is directly aware of the VPN connection and handles the encryption/decryption processes.

IPsec operates at the transport layer of the OSI model.

The AH (Authentication Header) protocol only provides data integrity and authentication, without encryption.

ESP (Encapsulating Security Payload) provides both encryption and authentication.

The IKE (Internet Key Exchange) protocol is used to establish the security associations (SAs) in an IPsec connection.

MD7 is a secure hash algorithm used for data integrity in IPsec.

RSA is used only for encryption and cannot be used for authentication in IPsec.

Diffie-Hellman is a key exchange algorithm used to securely exchange cryptographic keys over a public network.

In transport mode, IPsec encrypts the entire IP packet, including the header.

In tunnel mode, a new IP header is added to the original IP packet after encryption, providing additional security.

IKE Phase 1 is primarily used to negotiate IPsec policies for secure traffic transmission.

IKE Phase 2 is responsible for negotiating the IPsec security associations (SAs) to protect the data traffic.

When configuring a site-to-site IPsec VPN, the 'crypto isakmp key' command is used to define the encryption algorithm.

The 'access-list' command is used to define interesting traffic that will be protected by the VPN.

The 'crypto ipsec transform-set' command is used to specify the encryption and authentication algorithms for IPsec.

The crypto map only specifies which traffic to protect, and does not include security parameters for encryption or authentication.

The 'show crypto isakmp sa' command is used to verify the status of the IPsec security associations.

The 'show crypto ipsec sa' command displays the parameters and statistics related to the established IPsec security associations.

If the ISAKMP SA state is 'QM_IDLE', the IKE Phase 1 negotiation was unsuccessful.

Configuring 'pfs group24' provides weaker security than not enabling PFS.