300-730 · Question #220
What is the purpose of group members in a Cisco Group Encrypted Transport VPN architecture?
The correct answer is C. It provides an encryption service.. In Cisco GET-VPN, roles are split between the Key Server (KS) and Group Members (GMs). Group Members are the routers that perform the actual encryption and decryption of traffic flowing between sites.
Question
Options
- AIt services registration requests.
- BIt supplies group authentication keys.
- CIt provides an encryption service.
- DIt holds group authentication keys.
How the community answered
(56 responses)- A2% (1)
- B5% (3)
- C91% (51)
- D2% (1)
Why each option
In Cisco GET-VPN, roles are split between the Key Server (KS) and Group Members (GMs). Group Members are the routers that perform the actual encryption and decryption of traffic flowing between sites.
Servicing registration requests is the function of the Key Server, which listens for GDOI registration messages from Group Members.
Supplying group authentication keys is also a Key Server responsibility - it pushes KEK and TEK to authenticated Group Members.
Group Members in a GET-VPN architecture are the data-plane participants responsible for encrypting and decrypting unicast or multicast traffic using the keys provided by the Key Server. They do not manage or distribute keys - they consume them to provide the encryption service for payload traffic traversing the network.
Holding (storing) group authentication keys is another Key Server function, not a Group Member function.
Concept tested: GET-VPN Group Member role in architecture
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-16/sec-conn-getvpn-xe-16-book/sec-get-vpn.html
Topics
Community Discussion
No community discussion yet for this question.