Like a Site-to-Site VPN between two Security Gateways, a Remote Access VPN relies on the Internet Key Exchange (IKE) what types of keys are generated by IKE during negotiation?

Question

Options

• AProduce a symmetric key on both sides
• BProduce an asymmetric key on both sides
• CSymmetric keys based on pre-shared secret
• DProduce a pair of public and private keys

• B
  7% (2)
• C
  4% (1)
• D
  89% (24)

Explanation

During IKE negotiation, each Security Gateway generates a Diffie-Hellman (DH) public/private key pair - making D correct. Each side creates its own DH key pair, exchanges public keys over the network, and mathematically derives the same shared secret without ever transmitting the private key, which is the core security property of DH.

Option A is misleading because while symmetric keys are ultimately used to encrypt VPN traffic, they are derived from the DH exchange, not directly generated in isolation by each side independently. Option B is vague and incorrect phrasing - asymmetric keys alone don't describe the DH process, and "asymmetric key on both sides" doesn't capture the key exchange mechanism. Option C confuses authentication method with key generation - pre-shared secrets (PSK) are one way gateways authenticate to each other in Phase 1, but IKE can also use certificates, and PSK is not what IKE "generates."

Memory tip: Think of IKE as a two-phase lock combination - Phase 1 uses DH to generate public/private pairs (like combination halves) that are swapped to unlock a shared secret, which then feeds Phase 2's symmetric session keys. "IKE pairs up before it encrypts."

No community discussion yet for this question.