300-730 · Question #221
Which type of key must be used to encrypt the payload of packets sent between the members of a Cisco Group Encrypted Transport VPN?
The correct answer is C. TEK. Cisco GET-VPN uses two categories of keys - the KEK protects key distribution, and the TEK encrypts the actual data payload. Only the TEK (Traffic Encryption Key) is used to encrypt traffic between Group Members.
Question
Options
- AGDOI
- BIKEv2
- CTEK
- DKEK
How the community answered
(56 responses)- A4% (2)
- B2% (1)
- C93% (52)
- D2% (1)
Why each option
Cisco GET-VPN uses two categories of keys - the KEK protects key distribution, and the TEK encrypts the actual data payload. Only the TEK (Traffic Encryption Key) is used to encrypt traffic between Group Members.
GDOI (Group Domain of Interpretation) is the key management protocol used to distribute keys, not a key type used to encrypt payload traffic.
IKEv2 is not used in GET-VPN; GET-VPN relies on IKEv1 and GDOI for its key management framework.
The Traffic Encryption Key (TEK) is the symmetric key distributed by the Key Server to all Group Members and is used directly to encrypt and decrypt the payload of data packets exchanged between members. This allows any Group Member to decrypt traffic from any other member because they all share the same TEK, enabling the any-to-any encryption model GET-VPN is designed for.
The KEK (Key Encryption Key) is used to secure the GDOI control-plane messages that distribute the TEK, not to encrypt the actual data payload.
Concept tested: GET-VPN TEK vs KEK role in payload encryption
Source: https://www.cisco.com/c/en/us/td/docs/ios-xml/ios/sec_conn_getvpn/configuration/xe-16/sec-conn-getvpn-xe-16-book/sec-get-vpn.html
Topics
Community Discussion
No community discussion yet for this question.