Objective 3.3

Implement Secure Access Between Private Networks

16-23

B. Incorrect: The filter list for a tunnel mode IPSec policy is no different from the

list for a transport mode policy. You only have to specify port numbers if you want

to filter traffic based on the applications generating the traffic.

C. Correct: All IPSec policies must specify the algorithm that the system will use to

encrypt the protected data.

D. Incorrect: IPSec in tunnel mode is an arrangement between the two routers

functioning as endpoints for the tunnel. The only requirement for the clients and

servers making use of the tunnel is that they have access to the routers.

4.

Correct Answers: D

A. Incorrect: The Kerberos protocol is the default authentication method for Active

Directory networks. However, as these two networks are running completely sep-

arate Active Directory installations, clients on one network cannot be authenti-

cated by servers on the other.

B. Incorrect: Because neither network has a PKI in place, the use of digital certifi-

cates for IPSec authentication would not be practical.

C. Incorrect: Smart cards rely on digital certificates, which are stored on the cards.

Without a PKI in place, using smart cards for IPSec authentication would not be

practical.

D. Correct: Using a key that you have supplied to the administrators of the other

network beforehand, IPSec systems can authenticate each other without the need

for additional infrastructure.