156-215.77 · Question #409
Assume an intruder has compromised your current IKE Phase 1 and Phase 2 keys. Which of the following options will end the intruder's access after the next Phase 2 exchange occurs?
The correct answer is A. Perfect Forward Secrecy. See the full explanation below for the reasoning.
Question
Assume an intruder has compromised your current IKE Phase 1 and Phase 2 keys. Which of the following options will end the intruder's access after the next Phase 2 exchange occurs?
Options
- APerfect Forward Secrecy
- BSHA1 Hash Completion
- CPhase 3 Key Revocation
- DM05 Hash Completion
How the community answered
(21 responses)- A81% (17)
- B10% (2)
- C5% (1)
- D5% (1)
Community Discussion
6
Imani T.May 1, 2026Perfect Forward Secrecy is your answer here, and it is the only option that actually solves this problem. PFS forces a brand new Diffie-Hellman key exchange every time Phase 2 renegotiates, so even if an attacker has your current Phase 1 and Phase 2 keys in hand, those keys become useless after the next exchange because the new session keys are derived independently and have zero relationship to the compromised ones. Without PFS enabled, an attacker who cracked your Phase 1 master key could potentially derive future session keys, which is exactly the scenario this question is describing. The other options are either made-up distractors or unrelated concepts, so do not overthink it.
Mei-Ling H.Apr 25, 2026Got A on my real exam, the word "next" in the stem was the key, PFS generates fresh keys each Phase 2 so compromised keys expire.
Ola B.Apr 27, 2026PFS does protect you there, but worth noting it's the Phase 1 key material (SKEYID) that would be the bigger disaster if compromised, since that seeds the Phase 2 derivation, so lab it out with a packet capture and watch how fast those Phase 2 lifetimes actually roll.
Bahar F.Apr 15, 2026A, PFS generates fresh keys each Phase 2, cutting off the attacker cold. Saw this exact scenario on my 77 sitting, almost second-guessed myself toward D before remembering PFS is the whole point of independent session keying.
Wesley A.Apr 20, 2026I actually flagged this one on my first attempt because I second-guessed myself and picked B, thinking the hash had something to do with invalidating the session. PFS is the answer because it generates a fresh independent key for every Phase 2 exchange, so even if an intruder has everything from before, the next negotiation shuts them out completely since those old keys have zero relationship to the new ones.
Ola B.May 10, 2026Thought B was the fix until I remembered PFS generates fresh keys each Phase 2 exchange.