Test
Dialup IPsec VPN II
Este test tiene tipos de pregunta que se abren en el reproductor de siempre.
Preguntas del test (16)
1Uses UDP port 500 (and UDP port 4500 when crossing NAT)
Negotiates a tunnel’s private keys, authentication, and encryption
One lPsec SA is used per traffic direction.
Phases:
Phase1
Phase2- AIKE
- BESP
- CAH
2Phase 1 negotiation modes
- Amain mode
aggresive mode - Bmain mode
quick mode
- Amain mode
3Phase 2 negotiation mode
- Aaggresive mode
- Bquick mode
4takes place when each endpoint of the tunnel—the initiator and the responder—connects and begins to set up the VPN.
- APhase 1
- BPhase 2
5
[blank_start]2.[blank_end] Negotiate one bidirectional SA (called IKE SA) *ln IKE v1, two possible ways: -Main mode: six packets exchanged -Aggressive mode: three packets exchanged *Not the same as final SAs later *Encrypted tunnel for Diffie-Hellman (DH)
[blank_start]1 .[blank_end] Authenticate peers *Pre—shared key or digital signature *Extended authentication (XAuth)
[blank_start]3.[blank_end] DH exchange for secret keys- A2.
- B1 .
- C3.
6Key agreement method:
Independently calculate a private key using only public keys
Each FortiGate uses a shared secret key plus a nonce to calculate keys for the following:
Symmetric encryption algorithms (such as 3DES, AES)
Symmetric authentication (HMACs)- ADiffie-Hellman
- BIKE
- CESP
7ESP can´t support NAT because it has no port numbers.
- AVerdadero
- BFalso
8Negotiates two unidirectional SAs for ESP (called lPsec SAS)
Protected by phase IKE SA
When SAs are about to expire, it renegotiates
Optionally, if Perfect Forward Secrecy is set to Enabled, FortiGate uses Diffie-Hellman to generate new keys each time phase 2 expires.
Each phase 1 can have multiple phase 2s.
High security subnets can have stronger ESP.- APhase 2
- BPhase 1
9 Also, if you set ____________ to Enable, each time phase 2 expires, FortiGate will use Diffie-Hellman to recalculate new secret keys. In this way, new keys are not derived from older keys, making it much harder for an attacker to crack the tunnel.
- APerfect Forward Secrecy
- BNAT-Transversal
- CSplit tunneling
10If multiple phase 2 exist, FortiGate directs traffic to the correct phase 2.
Allows granular security settings for each LAN.
If traffic does not match an lPsec SA selector, it is dropped.
ln point-to-pointVPNs, selectors must match.
- The source on one FortiGate is the destination setting on the other.
Select which SA to apply using:
Destination and source IP subnet(s)
Protocol number
Source port and destination port- AQuick mode selectors
- BPhase 2
- CPhase 1
- DAgressive mode
11During phase 2, you must configure a pair of settings called quick mode selectors. They identify and direct traffic to the appropriate phase 2. In other words, they allow granular SAs.
- AVerdadero
- BFalso
12In aggressive mode, how many packets are exchanged to establish phase 1 of the lPsec tunnel?
- AA. Six
- BB. Three
13Which statement about quick mode selectors is true?
- AA. Only phase 2 has quick mode selectors.
- BB. Only phase 1 has quick mode selectors.
14Settings need in Dialup VPN between two fortigates
- AA phase 1
At least one phase 2
Firewall policies
Static routes or a dynamic routing protocol - BA phase 1
At least one phase 2
Firewall policies
Static routes or a dynamic routing protocol
IPsec interface
- AA phase 1
15Dialup IPsec is also known as
- AA. point-to-point
- BB. point-to—multipoint
16IKE mode configuration automatically configures network settings?
- AA. client
- BB. server
Información
- Descripción
- El usuario ha eliminado su información de asignaturas Test sobre Dialup IPsec VPN II, creado por Usuario eliminado el 20/09/2018.
- Autor
- Usuario eliminado
- Idioma
- English
- Visitas
- 38
- Historial
- Creado el 20 sep 2018 · actualizado el 11 abr 2019
- Etiquetas