You are consultant network designer for a large GET VPN deployment for a large bank with International coverage. Between 1800 and 2000 remote locations connect to the central location through four…

Question

Options

• AIncrease the cryptographic key size.
• BReplace unicast rekey with multicast rekey.
• CReduce the SAR clock interval duration
• DIncrease the TEK and KEK lifetime.
• EReduce the Dead Peer Detection periodic timer.

Explanation

Correct answers: A and C

Increasing the cryptographic key size (A) directly strengthens encryption security - larger keys (e.g., AES-256 over AES-128) make brute-force attacks exponentially harder, addressing the bank's security concern. Reducing the SAR (Security Association Replay) clock interval (C) tightens GET VPN's time-based anti-replay window, meaning captured packets become invalid more quickly, directly countering replay attacks in a group VPN environment where sequence-number-based anti-replay isn't feasible.

Why the distractors are wrong:

• B (multicast rekey): Improves scalability for large group sizes but does not enhance security or replay protection.
• D (increase TEK/KEK lifetime): Longer key lifetimes mean keys are rotated less often, which weakens security - the opposite of what the bank needs.
• E (reduce DPD timer): Dead Peer Detection controls failover speed, not encryption strength or replay resistance.

Memory tip: Think of the two threats separately - "security = key strength (A)" and "replay = time window tightness (C)." SAR stands for Security Association Replay, so "reduce SAR interval = reduce replay window = reduce replay risk" is a direct logical chain.

No community discussion yet for this question.