A network architect is troubleshooting the L2TPv3 tunneling security due to the untrusted nature of the underlaying network. Which two L2TPv3 features does the architect deploy to address the…

Question

Options

• ATCP MD5 authentication
• Bcontrol message hashing
• CCHAP authentication
• Dcontrol message rate limiting
• Easymmetric mutual authentication with PSK

• A
  3% (1)
• B
  77% (30)
• D
  15% (6)
• E
  5% (2)

Explanation

Control message hashing (B) and CHAP authentication (C) are the two native L2TPv3 security mechanisms defined in RFC 3931 for securing tunnels over untrusted networks - hashing provides integrity and authentication of control plane messages using HMAC-MD5 or HMAC-SHA1, while CHAP is used during L2TPv3 tunnel establishment to authenticate the remote peer.

Why the distractors are wrong:

• A (TCP MD5): This is a BGP session security feature; L2TPv3 uses UDP or raw IP (protocol 115), not TCP, so TCP MD5 simply doesn't apply.
• D (Control message rate limiting): Rate limiting is a DoS mitigation technique but is not a defined L2TPv3 security feature for addressing authenticity or integrity on untrusted networks.
• E (Asymmetric mutual authentication with PSK): This is self-contradictory - PSK (pre-shared key) is inherently symmetric; asymmetric authentication uses certificates/PKI. Neither is a native L2TPv3 feature.

Memory tip: Think "HC secures L2TPv3" - Hashing for control message integrity, CHAP for peer authentication. Both are built into RFC 3931 itself, while the wrong answers either belong to other protocols (TCP MD5 → BGP) or aren't L2TPv3-native security mechanisms.

No community discussion yet for this question.