Study. uk . com
  1. Home
  2. All questions
  3. Question 282

CISSP study material · question 282 of 500

An organisation proposes to run RFC 4301-conformant IPsec using IKEv1. Which two capabilities does the document say IKEv1 lacks? Choose two.

  1. Deriving keys from a pre-shared secret.
  2. Negotiating multiple associations that share the same selectors.
  3. Establishing associations in tunnel mode.
  4. Negotiating an association that represents ranges of local and remote ports.
Show the answer

Answer: D. Negotiating an association that represents ranges of local and remote ports.
B. Negotiating multiple associations that share the same selectors.

RFC 4301 mandates features available in IKEv2 but not IKEv1, naming negotiation of an association representing port ranges and negotiation of multiple associations with the same selectors.

Source: RFC 4301 (IETF) — RFC 4301 > 3.2 How IPsec Works

Challenge yourself on this topic → Study as cards