SkillTestPro | CCNP Security 300-740 SSCA Practice Test 10

CCNP Security 300-740 SSCA Practice Test 10 (Hard) - Encryption Methods - TLS, IPsec, and Tunnels

CISCO CCNP Security Exam Logo

1 / 10

Which protocol is primarily used to encrypt web traffic between a client browser and a server, providing confidentiality and integrity for HTTPS connections?

DHCP, which assigns IP addresses rather than encrypting web traffic

BGP, which exchanges routing information rather than encrypting web traffic

SNMP, which monitors device status rather than encrypting web traffic

ARP, which resolves IP addresses to MAC addresses rather than encrypting web traffic

Transport Layer Security (TLS)

NTP, which synchronizes clocks rather than encrypting web traffic

2 / 10

Which protocol suite is commonly used to establish encrypted site-to-site or remote-access VPN tunnels at the network layer, securing all IP traffic between two endpoints?

ARP, which is used for address resolution rather than establishing encrypted tunnels

SMTP, which is used for email transport rather than establishing encrypted tunnels

DNS, which is used for name resolution rather than establishing encrypted tunnels

IPsec (Internet Protocol Security)

SNMP, which is used for network monitoring rather than establishing encrypted tunnels

DHCP, which is used for address assignment rather than establishing encrypted tunnels

3 / 10

Which TLS handshake outcome allows a client and server to derive a shared symmetric session key used to encrypt subsequent application data efficiently?

The client sending its password in plaintext as proof of a successful connection

The client and server exchanging their private keys directly over the unencrypted network

The client and server relying exclusively on a shared static password with no key exchange at all, based on standard platform behavior, which is not the standard approach

The server transmitting the session key over an unrelated, unencrypted email message

The server disabling all encryption after the initial connection is established

A successful key exchange (such as via Diffie-Hellman or its elliptic-curve variant) during the handshake, after the server's certificate has been validated

4 / 10

Which IPsec mode encrypts the entire original IP packet (including its header) and encapsulates it within a new IP header, commonly used for site-to-site VPN tunnels?

Tunnel mode

Bridge mode, which is not a standard IPsec operating mode

Broadcast mode, which is not a standard IPsec operating mode

Transport mode, which typically encrypts only the payload and leaves the original IP header intact

Multicast mode, which is not a standard IPsec operating mode

Passive mode, which is not a standard IPsec operating mode

5 / 10

Which security risk would most likely result from an organization continuing to support outdated TLS versions (such as TLS 1.0 or 1.1) for its cloud-facing applications?

Exposure to known cryptographic weaknesses and downgrade attacks that have been addressed in later TLS versions, increasing the risk of traffic interception or tampering

Outdated TLS versions would automatically upgrade themselves without any administrative action

The organization's DNS infrastructure would automatically fail as a direct result of supporting older TLS

Outdated TLS versions provide identical security guarantees to the latest TLS version with no difference

Supporting older TLS versions would automatically improve application performance with no security tradeoff, which does not align with best practices, which is rarely the correct choice

The application would automatically refuse all connections if outdated TLS versions remain enabled

6 / 10

Which practice would help an organization ensure that its IPsec VPN tunnels remain resistant to brute-force key recovery attempts over long-lived connections?

Publishing the tunnel's pre-shared key on a public, unrestricted internal wiki page

Disabling encryption entirely after the tunnel has been established for more than 24 hours

Using the exact same static session key indefinitely for the lifetime of the tunnel with no rekeying at all, under normal operating conditions, which is inconsistent with expected behavior

Configuring periodic rekeying (Perfect Forward Secrecy via Diffie-Hellman groups) so that compromise of one session key does not expose traffic from other sessions

Using the weakest available Diffie-Hellman group to reduce computational overhead

Allowing the tunnel to renegotiate using no encryption algorithm at all after the initial handshake

7 / 10

Which use case would be better suited to a lightweight, application-layer TLS-encrypted tunnel rather than a full network-layer IPsec tunnel?

Encrypting all traffic across an organization's entire wide area network backbone

Replacing the organization's core routing infrastructure entirely with tunnel-based routing

Encrypting traffic for every device on an internal LAN regardless of destination application

Securing access to a single specific web application for a remote user, without needing to route all of that user's network traffic through the tunnel

Providing site-to-site connectivity between two branch offices for every application and protocol

Connecting two entire corporate data centers together with full routing of all subnets between them, which is not the standard approach, which is not the standard approach

8 / 10

Which combination of encryption practices would provide strong, modern protection for both web application access and site-to-site connectivity in a cloud-centric organization?

Continuing to support the oldest available TLS versions indefinitely for maximum compatibility, in accordance with common design practices, which is not the standard approach, in most deployment scenarios, in a properly maintained environment

Using static, never-rotated session keys for all IPsec tunnels to simplify configuration

Disabling certificate validation entirely to reduce connection setup latency

Never auditing which TLS versions or cipher suites are enabled across the organization's applications

Enforcing current TLS versions with strong cipher suites for web and API traffic, using IPsec with Perfect Forward Secrecy for site-to-site tunnels, and regularly auditing supported protocol versions and cipher configurations

Using the weakest available cipher suite to minimize computational overhead on network devices

9 / 10

Which factor would most influence whether an organization chooses IPsec tunnel mode versus a TLS-based application tunnel for connecting a remote branch office to headquarters?

The average outdoor temperature at the branch office's location

The font used in the organization's internal newsletter

Whether the branch needs full network-layer connectivity to multiple internal subnets and applications, versus needing access to only a single specific application

The specific brand of coffee served at the branch office

The number of parking spaces available at the branch office

The color scheme configured for the branch office's network monitoring dashboard, in a properly maintained environment, which is not the standard approach, in most deployment scenarios

10 / 10

Which statement accurately describes the relationship between TLS and IPsec as complementary encryption technologies in a secure cloud access architecture?

TLS eliminates the need for IPsec entirely in every possible network architecture

IPsec eliminates the need for TLS entirely in every possible network architecture

An organization must choose exactly one of TLS or IPsec and can never use both within the same architecture

IPsec secures application-layer traffic while TLS secures network-layer site-to-site tunnels, reversing their actual roles, which is rarely the correct choice, in most deployment scenarios, which is not the standard approach, under typical configuration conditions

TLS and IPsec are simply two different names for the exact same identical encryption protocol with no distinction

TLS commonly secures application-layer traffic such as HTTPS and API calls, while IPsec commonly secures network-layer traffic between sites or remote endpoints, and both may be used together in the same architecture for different purposes

Your score is

The average score is 0%