300-420 Question 196
Select 3A company is designing a secure site-to-site VPN between two branch offices using IPsec. They want to ensure data confidentiality, data integrity, and authentication during transmission. Which combination of protocols or standards should be used to meet these requirements?
- A
AES for data confidentiality
- B
SHA-2 for data integrity
- C
IKEv2 for key exchange and authentication
- D
GRE for encapsulation and encryption
- E
MD5 for data integrity
Show answer and explanation
Correct answers: A, B, C
Explanation
To design a secure IPsec VPN, a combination of protocols is required to address confidentiality, integrity, and authentication. AES is used for encryption to protect data confidentiality, SHA-2 ensures data integrity by verifying that the data has not been altered, and IKEv2 provides a secure method for exchanging encryption keys and authenticating the endpoints. GRE and MD5 are not appropriate for this scenario, as GRE does not provide encryption, and MD5 is considered insecure for modern cryptographic needs.
- A. Correct.
AES (Advanced Encryption Standard) is used to provide data confidentiality by encrypting the transmitted data within the IPsec framework.
- B. Correct.
SHA-2 (Secure Hash Algorithm 2) is a cryptographic hash function used in IPsec to ensure data integrity, making it a secure choice for protecting against tampering.
- C. Correct.
IKEv2 (Internet Key Exchange version 2) is a protocol used in IPsec for secure key exchange and mutual authentication between the two endpoints in the VPN.
- D. Incorrect.
GRE (Generic Routing Encapsulation) is a tunneling protocol used for encapsulation, but it does not provide encryption or security features like IPsec does.
- E. Incorrect.
MD5 (Message Digest Algorithm 5) is a deprecated hash function due to its vulnerabilities, and it is not recommended for ensuring data integrity in secure communications.