300-420 Question 204
Select 2An enterprise network is deploying Group Encrypted Transport VPN (GET VPN) to ensure secure communication between its branch offices. The network design must meet the following requirements:
- Minimize the latency introduced during encryption and decryption processes.
- Ensure that the communication remains secure even if the key server is temporarily unavailable.
- Allow seamless integration with the existing MPLS network without tunneling overhead.
Which two features of GET VPN fulfill these requirements?
- A
Key server failover support to maintain security during key server unavailability
- B
Support for IPsec tunneling to integrate with MPLS networks
- C
Scalability through the use of a group-based policy and key management
- D
Native packet transport without additional tunneling overhead
- E
Encryption and decryption performed on a per-packet basis to minimize latency
Show answer and explanation
Correct answers: A, D
Explanation
GET VPN is designed to provide secure communication for enterprises without relying on tunneling, making it ideal for use with MPLS networks by preserving the original IP header. Additionally, its key server failover mechanism ensures uninterrupted secure communication even during key server outages. These features align perfectly with the requirements mentioned in the scenario.
- A. Correct.
GET VPN supports key server failover, ensuring that even if the primary key server becomes unavailable, the group members can continue secure communication using the previously shared keys.
- B. Incorrect.
GET VPN does not use IPsec tunneling; instead, it encrypts traffic natively. This makes it unsuitable for scenarios requiring traditional IPsec tunneling.
- C. Incorrect.
While GET VPN is scalable due to group-based policy and key management, this feature does not directly address the requirements in the scenario.
- D. Correct.
GET VPN encrypts packets natively without adding tunneling overhead, which allows seamless integration with MPLS networks and meets the requirement for no additional overhead.
- E. Incorrect.
Encryption and decryption in GET VPN do not occur on a per-packet basis to minimize latency. Instead, it uses session keys for group communication.