nerdexam
CompTIA

CAS-003 · Question #301

A network engineer is attempting to design-in resiliency characteristics for an enterprise network's VPN services. If the engineer wants to help ensure some resilience against zero-day…

The correct answer is D. Employ a second VPN layer concurrently where the other layer's cryptographic implementation is. Tests knowledge of VPN resilience strategies specifically targeting zero-day vulnerabilities in cryptographic implementations.

Enterprise Security Architecture

Question

A network engineer is attempting to design-in resiliency characteristics for an enterprise network's VPN services. If the engineer wants to help ensure some resilience against zero-day vulnerabilities exploited against the VPN implementation, which of the following decisions would BEST support this objective?

Options

  • AImplement a reverse proxy for VPN traffic that is defended and monitored by the organization's
  • BSubscribe to a managed service provider capable of supporting the mitigation of advanced DDoS
  • CDistribute the VPN concentrators across multiple systems at different physical sites to ensure
  • DEmploy a second VPN layer concurrently where the other layer's cryptographic implementation is

How the community answered

(31 responses)
  • A
    26% (8)
  • B
    10% (3)
  • C
    6% (2)
  • D
    58% (18)

Why each option

Tests knowledge of VPN resilience strategies specifically targeting zero-day vulnerabilities in cryptographic implementations.

AImplement a reverse proxy for VPN traffic that is defended and monitored by the organization's

A reverse proxy adds a monitoring and inspection layer in front of VPN traffic but does not protect against a zero-day vulnerability in the VPN implementation's own code or cryptographic stack.

BSubscribe to a managed service provider capable of supporting the mitigation of advanced DDoS

A managed DDoS mitigation service addresses volumetric availability attacks, not the exploitation of software vulnerabilities within a VPN implementation.

CDistribute the VPN concentrators across multiple systems at different physical sites to ensure

Distributing VPN concentrators across multiple physical sites provides high availability and geographic resilience but does not reduce the risk from a zero-day vulnerability that is present in all instances of the same implementation.

DEmploy a second VPN layer concurrently where the other layer's cryptographic implementation isCorrect

Deploying two concurrent VPN layers using distinct cryptographic implementations (heterogeneous stacks) means a zero-day exploit targeting one implementation's cryptographic library or protocol does not expose the full tunnel. An attacker would need to simultaneously exploit vulnerabilities in two completely independent VPN stacks, dramatically reducing the probability of a successful attack.

Concept tested: Cryptographic diversity for VPN zero-day resilience

Source: https://csrc.nist.gov/publications/detail/sp/800-77/rev-1/final

Topics

#VPN resilience#zero-day mitigation#cryptographic diversity#network architecture

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CAS-003 Practice