nerdexam
GIAC

GSLC · Question #116

US Garments wants all encrypted data communication between corporate office and remote location. They want to achieve following results: - Authentication of users - Anti-replay - Anti-spoofing - IP…

The correct answer is B. Anti-spoofing C. Anti-replay. IPSec Authentication Header (AH) provides integrity, anti-replay, and anti-spoofing but does not encrypt the IP payload, so it satisfies anti-spoofing and anti-replay requirements but not user authentication or packet encryption.

Security Architecture & Engineering

Question

US Garments wants all encrypted data communication between corporate office and remote location. They want to achieve following results:

  • Authentication of users
  • Anti-replay
  • Anti-spoofing
  • IP packet encryption

They implemented IPSec using Authentication Headers (AHs). Which results does this solution provide? (Click the Exhibit button on the toolbar to see the case study.) Each correct answer represents a complete solution. Choose all that apply.

Options

  • AAuthentication of users
  • BAnti-spoofing
  • CAnti-replay
  • DIP packet encryption

How the community answered

(29 responses)
  • A
    14% (4)
  • B
    76% (22)
  • D
    10% (3)

Why each option

IPSec Authentication Header (AH) provides integrity, anti-replay, and anti-spoofing but does not encrypt the IP payload, so it satisfies anti-spoofing and anti-replay requirements but not user authentication or packet encryption.

AAuthentication of users

AH provides data-origin authentication at the IP packet level by verifying the source IP address, but it does not perform user-level authentication such as username/password or certificate-based identity verification for individual users.

BAnti-spoofingCorrect

AH authenticates the source IP address by computing a cryptographic HMAC over the packet headers, which prevents an attacker from forging the source address and therefore provides anti-spoofing protection.

CAnti-replayCorrect

AH includes a sequence number field that IPSec peers use to detect and discard duplicate or out-of-order packets, directly providing anti-replay protection against attackers who capture and retransmit packets.

DIP packet encryption

AH does not encrypt the IP payload - it only provides integrity and authentication via HMAC; encryption of IP packet contents requires IPSec ESP (Encapsulating Security Payload), not AH.

Concept tested: IPSec Authentication Header capabilities and limitations vs ESP

Source: https://datatracker.ietf.org/doc/html/rfc4302

Topics

#IPSec#Authentication Header#anti-replay#packet integrity

Community Discussion

No community discussion yet for this question.

Full GSLC Practice