Which exchange lakes care of DoS protection in IKEv2?

Question

Options

• ACreate_CHILD_SA
• BIKE_Auth
• CIKE_Req_INIT
• DIKE_SA_NIT

• A
  7% (2)
• B
  3% (1)
• C
  90% (26)

Explanation

IKE_SA_INIT (represented here as IKE_Req_INIT) handles DoS protection in IKEv2 through a cookie challenge mechanism. When a responder detects it may be under a flooding attack, it can respond to the initiator's first message with a COOKIE notification, requiring the initiator to resend the request with that cookie included before the responder allocates any state or CPU-intensive resources (like Diffie-Hellman computation). This proves the initiator's IP is reachable and filters out spoofed-source attacks cheaply.

Why the others are wrong:

• A (CREATE_CHILD_SA): Occurs after both peers are already authenticated and an IKE SA exists - too late in the process for initial DoS protection.
• B (IKE_AUTH): Handles mutual authentication and establishes the first Child SA, but by this point the responder has already committed DH resources - protection would be too late.
• D (IKE_SA_NIT): Not a valid IKEv2 exchange name; this is a distractor, likely a misspelling of IKE_SA_INIT to confuse test-takers.

Memory tip: Think "INIT = Initiate protection first." DoS cookies must fire at the very first exchange before any heavy crypto work begins - if the gate isn't at the door (INIT), attackers waltz in for free.

No community discussion yet for this question.