Secure Connectivity and Segmentation for CCIE Security Written v5.0 (400-251)

Sample Practice Questions

1. Question 1

   Refer to the exhibit. Which message could contain an authenticated initial_contact notify during IKE main mode negotiation?
   1. A. message 3
   2. B. message 5
   3. C. message 1
   4. D. none, initial_contact is sent only during quick mode
   5. E. none, notify messages are sent only as independent message types
   Explanation

   The correct answer is: B. message 5.

   The exhibit walks through IKEv1 main mode, and the key fact is which of those six messages is the first one that is both encrypted and authenticated. Messages 1 and 2 carry the ISAKMP SA proposals and vendor ID payloads in the clear. Messages 3 and 4 carry the Diffie-Hellman key exchange and nonce payloads, after which each peer can compute SKEYID and the derived encryption and authentication keys, but nothing in message 3 or 4 has yet proven who the peer is. Messages 5 and 6 are the first pair sent under ISAKMP encryption, and they carry the identity payload together with the hash or signature that authenticates it. An INITIAL_CONTACT notify tells the peer that this is a fresh contact and that any stale SAs for the same identity should be torn down, which is a destructive instruction and therefore must be trusted, so it belongs in the earliest authenticated message, which is message 5. Quick mode is far too late for that purpose, and notify payloads are perfectly legal as piggybacked payloads inside an existing exchange rather than only as standalone informational messages.

2. Question 2

   Which two statements are correct regarding the AES encryption algorithm? (Choose two.)
   1. A. It is a FIPS-approved symmetric block cipher.
   2. B. It supports a block size of 128, 192, or 256 bits.
   3. C. It supports a variable length block size from 16 to 448 bits.
   4. D. It supports a cipher key size of 128, 192, or 256 bits.
   5. E. The AES encryption algorithm is based on the presumed difficulty of factoring large integers.
   Explanation

   The correct answers are: A. It is a FIPS-approved symmetric block cipher., D. It supports a cipher key size of 128, 192, or 256 bits..

   AES is the Rijndael cipher as standardised in FIPS PUB 197 and approved for United States federal use, which makes it a FIPS-approved symmetric block cipher: the same secret key both encrypts and decrypts, and data is processed in fixed-size blocks rather than as a byte stream. The key length is the part that varies, with three approved sizes of 128, 192 and 256 bits driving 10, 12 and 14 rounds respectively, which is why an IPsec transform set can specify esp-aes, esp-aes 192 or esp-aes 256. The block size is not variable at all: while the original Rijndael submission allowed other block lengths, the standardised AES fixes the block at 128 bits for every key size, so any claim that the block grows with the key confuses the two parameters. A variable length block from 16 to 448 bits does not describe any AES mode, and the 448-bit figure belongs to the maximum key length of Blowfish. Security resting on the difficulty of factoring large integers describes RSA, an asymmetric algorithm used for signatures and key transport; AES security instead rests on the resistance of its substitution and permutation network to differential and linear cryptanalysis.

3. Question 3

   What are two benefits of using IKEv2 instead of IKEv1 when deploying remote-access IPsec VPNs? (Choose two.)
   1. A. IKEv2 supports EAP authentication methods as part of the protocol.
   2. B. IKEv2 inherently supports NAT traversal.
   3. C. IKEv2 messages use random message IDs.
   4. D. The IKEv2 SA plus the IPsec SA can be established in six messages instead of nine messages.
   5. E. All IKEv2 messages are encryption-protected.
   Explanation

   The correct answers are: A. IKEv2 supports EAP authentication methods as part of the protocol., B. IKEv2 inherently supports NAT traversal..

   For remote-access deployments the two concrete IKEv2 advantages are native EAP support and native NAT traversal. EAP is part of the protocol itself, carried in the IKE_AUTH exchange, so the client can be authenticated against a RADIUS server with EAP-MSCHAPv2 or a certificate-based inner method while the headend proves itself with its own certificate; IKEv1 has no protocol-level EAP and relies on the separate XAUTH extension. NAT traversal is likewise built in: both peers include NAT_DETECTION_SOURCE_IP and NAT_DETECTION_DESTINATION_IP notify payloads in IKE_SA_INIT, and if the hashes do not match the addresses seen on the wire the peers immediately move to UDP 4500 and encapsulate ESP in UDP, whereas IKEv1 acquired this behaviour through a later vendor-identifier-negotiated add-on. The message ID claim is wrong because IKEv2 message IDs are a strictly incrementing counter starting at zero, which is what allows window-based reliability and replay protection. The message count is also wrong: IKEv2 brings up the IKE SA and the first child SA in four messages, not six. And not every message is encrypted, since the IKE_SA_INIT pair must travel in the clear to establish the keys in the first place.

4. Question 4

   Which three statements are true about MACsec? (Choose three.)
   1. A. It supports GCM modes of AES and 3DES.
   2. B. It is defined under IEEE 802.1AE.
   3. C. It provides hop-by-hop encryption at Layer 2.
   4. D. MACsec expects a strict order of frames to prevent anti-replay.
   5. E. MKA is used for session and encryption key management.
   6. F. It uses EAP PACs to distribute encryption keys.
   Explanation

   The correct answers are: B. It is defined under IEEE 802.1AE., C. It provides hop-by-hop encryption at Layer 2., E. MKA is used for session and encryption key management..

   MACsec is standardized in IEEE 802.1AE, which defines the SecTAG that carries the association number, the packet number and the secure channel identifier, plus the integrity check value appended to each frame. It operates hop by hop at Layer 2 rather than end to end, so a frame is decrypted and re-encrypted at every MACsec-capable link; that is what allows an intermediate switch to inspect and act on the clear frame, and it is also why MACsec cannot protect traffic across a device that does not participate. Key management is handled by MKA, the MACsec Key Agreement protocol carried in EAPoL-MKA frames, where an elected key server distributes secure association keys derived from the connectivity association key. The claim about GCM modes of AES and 3DES is wrong because the defined cipher suites are GCM-AES-128 and GCM-AES-256; 3DES has no GCM mode since GCM requires a 128-bit block cipher. MACsec does not require strict frame ordering: replay protection uses a configurable window, and commands such as macsec replay-protection window-size 100 explicitly tolerate reordering introduced by the network. Protected access credentials belong to EAP-FAST tunnel establishment, not to MACsec key distribution.

5. Question 5

   Which SSL protocol takes an application message to be transmitted, fragments the data into manageable blocks, optionally compresses the data, applies a MAC, encrypts, adds a header, and transmits the resulting unit in a TCP segment?
   1. A. SSL Handshake Protocol
   2. B. SSL Alert Protocol
   3. C. SSL Record Protocol
   4. D. SSL Change CipherSpec Protocol
   Explanation

   The correct answer is: C. SSL Record Protocol.

   SSL and TLS are layered, and the description given is the job of the Record Protocol, which is the bottom sublayer sitting directly on TCP. It takes an application message, fragments it into blocks no larger than 16384 bytes, optionally compresses each block with the negotiated compression method, computes a message authentication code over the sequence number, header and payload using the write MAC secret, encrypts the compressed data together with the MAC using the negotiated cipher and write key, prepends the record header carrying content type, version and length, and hands the result to TCP for transmission. Every other SSL protocol is itself carried as a record with a particular content type, which is the key insight. The Handshake Protocol negotiates the cipher suite, authenticates the peers with certificates and establishes the master secret from which the write keys and MAC secrets are derived, but it does no per-record framing. The Change CipherSpec Protocol is a single byte message whose only purpose is to signal that subsequent records use the newly negotiated parameters. The Alert Protocol carries warning and fatal condition codes such as a bad certificate, again as a record rather than as the framing mechanism.

Other CCIE Security Written v5.0 (400-251) domains

• Advanced Threat Protection and Content Security (10 questions)
• Identity Management, Information Exchange, and Access Control (33 questions)
• Infrastructure Security, Virtualization, and Automation (145 questions)
• Perimeter Security and Intrusion Prevention (54 questions)