Cisco CCNP Security Core (SCOR) 350-701Network SecurityMedium
A network architect is designing a secure network for a new branch office that will connect to the main corporate data center over the public internet. The design requires ensuring data confidentiality, integrity, and authenticity between the branch and the data center. Which technology is best suited to meet these requirements for site-to-site connectivity?
- AIP Security (IPsec) VPN
- BSecure Shell (SSH)
- CDomain Name System Security Extensions (DNSSEC)
- DSecure Sockets Layer (SSL)/Transport Layer Security (TLS)
Show answer & explanationAnswer & explanation
Correct answer: A. IP Security (IPsec) VPN
IPsec VPN is the standard protocol suite for establishing secure site-to-site connections over an untrusted network like the internet, providing confidentiality, integrity, and authenticity for all traffic between the two sites.
Why the other options are wrong
- B. SSH is used for secure remote command-line access and file transfer, not for establishing a secure tunnel for all network traffic between two sites.
- C. DNSSEC adds security to the DNS protocol by authenticating DNS responses, but it does not provide confidentiality or integrity for general network traffic between sites.
- D. SSL/TLS is primarily used to secure individual application-layer sessions (e.g., HTTPS), not for securing all network traffic between two sites.
IPsec VPN
IPsec VPN (Internet Protocol Security Virtual Private Network) is a suite of protocols that provides cryptographic protection for IP communications, commonly used to create secure tunnels between networks (site-to-site VPNs) or remote users and a network (remote-access VPNs).
- Provides confidentiality (encryption), integrity (hashing), and authenticity (authentication).
- Operates at the network layer (OSI Layer 3).
- Uses two main protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP).
- Can be implemented in tunnel mode (for networks) or transport mode (for hosts).
Memory trick: IPsec: 'IP' traffic gets 'SEC'ured for the whole site.