📝 SSL TLS transport layer security (13 MCQs)
📖 From Data Communication and Networks • 32. Internet Security • 13 questions available
What is SSL TLS transport layer security?
SSL and its successor TLS are cryptographic protocols operating at the transport layer that provide secure communication channels between clients and servers by ensuring privacy, message integrity, and endpoint authentication.
📝 All SSL TLS transport layer security MCQs
Q1. In IPSec transport mode, which part of the original IP packet remains unprotected?
📖 Explanation: Transport mode encrypts only the payload that comes from the transport layer, leaving the original IP header untouched. Because the header is not encapsulated, it can be read by intermediate routers, which is why the IP header remains unprotected in this mode.
Q2. Why can't traditional transport‑layer security protocols be directly applied to UDP traffic?
📖 Explanation: Traditional transport‑layer security protocols, such as TLS, rely on a handshake that establishes stateful connections. UDP is connectionless and does not maintain session state, so the handshake cannot be reliably performed. Without a persistent connection, key exchange and sequence tracking become impossible, preventing direct application of those protocols to UDP traffic.
Q3. If IPSec is configured in transport mode and the packet passes through a NAT device that modifies the source IP address, what is the most likely outcome?
📖 Explanation: In transport mode only the payload is encrypted, leaving the original IP header exposed. When a NAT device modifies the source address, the header seen by the receiver differs from the one used when the packet was authenticated. Consequently, the integrity check fails, causing the packet to be rejected.
Q4. Which statement correctly describes the overhead difference between IPSec transport mode and tunnel mode?
📖 Explanation: Transport mode encapsulates only the upper‑layer payload, so it adds the ESP or AH header but does not introduce a new outer IP header. Tunnel mode, however, wraps the entire original IP packet inside a new outer IP header, resulting in additional header bytes and therefore higher bandwidth and processing overhead compared with transport mode.
Q5. For a site‑to‑site VPN connecting two corporate networks, which IPSec mode is generally preferred and why?
📖 Explanation: Site‑to‑site VPNs aim to connect entire networks while hiding internal addressing schemes. Tunnel mode encapsulates the original IP packet inside a new outer IP header, effectively masking internal IP addresses from the public Internet. This encapsulation, together with optional encryption, makes tunnel mode the preferred choice for most corporate VPN deployments.
Q6. Which of the following correctly differentiates the Authentication Header (AH) and Encapsulating Security Payload (ESP) protocols?
📖 Explanation: The Authentication Header (AH) provides integrity protection and anti‑replay services but does not encrypt the payload, so confidentiality is absent. The Encapsulating Security Payload (ESP) can encrypt the payload for confidentiality and also offers optional integrity protection via an authentication trailer. Therefore, ESP can deliver both confidentiality and integrity, while AH offers only integrity.
Q7. At which layer of the OSI model does IPSec primarily operate?
📖 Explanation: IPSec is defined as a suite of protocols that operate at the network layer (Layer 3) of the OSI model. It secures IP packets by providing authentication, integrity, and optional confidentiality, which makes it fundamentally a network‑layer security mechanism rather than a transport‑ or application‑layer solution.
Q8. How does the choice of IPSec mode affect packet encapsulation?
📖 Explanation: In transport mode, IPSec encrypts only the payload that originates from the transport layer, leaving the original IP header untouched. Tunnel mode, on the other hand, wraps the entire original IP packet inside a new outer IP header and then applies encryption, resulting in a double‑encapsulated packet.
Q9. To secure a real‑time video stream that uses UDP, which combination of protocols would provide both transport‑layer security and application‑layer protection?
📖 Explanation: DTLS (Datagram TLS) is the UDP‑compatible counterpart of TLS, providing handshake, authentication, and encryption for datagram traffic. Combining DTLS with IPSec in tunnel mode adds a network‑layer protective envelope around the UDP packets, ensuring both application‑layer security (via DTLS) and network‑layer confidentiality and integrity (via IPSec).
Q10. For a multicast application that requires both authentication and confidentiality, which IPSec protocol(s) and mode should be selected?
📖 Explanation: ESP is capable of both encrypting the payload for confidentiality and adding an authentication trailer for integrity. When configured in tunnel mode, ESP encapsulates the entire original IP packet, which is essential for multicast traffic that traverses multiple networks. This combination satisfies the requirement for both authentication and confidentiality in a multicast scenario.
Q11. When comparing AH and ESP in tunnel mode, which statement about their processing overhead is most accurate?
📖 Explanation: AH adds only an authentication header to the original packet, which incurs processing for integrity verification but no encryption. ESP, especially in tunnel mode, adds an outer IP header and encrypts the encapsulated payload, leading to additional CPU cycles for encryption and decryption. Consequently, ESP usually has higher processing overhead than AH.
Q12. If two IPSec peers negotiate Security Associations (SAs) with mismatched encryption algorithms, what is the most likely result during data exchange?
📖 Explanation: Security Associations define the cryptographic parameters used between peers. If the peers negotiate mismatched encryption algorithms, the receiver will not be able to decrypt the incoming ciphertext, causing decryption failures. As a result, the packets are discarded, and communication cannot proceed until the SA parameters are renegotiated to match.
Q13. Design a secure client‑server communication that uses IPSec transport mode while traversing NAT. Which additional mechanism is required to maintain security?
📖 Explanation: NAT devices modify IP address and port information, which interferes with ESP’s direct encapsulation of IP packets. NAT‑Traversal (NAT‑T) encapsulates ESP inside UDP packets, allowing NAT devices to translate addresses without breaking the security association. This technique enables IPSec transport mode to function correctly across NAT while preserving confidentiality and integrity.