NSE4 Authentication and VPN Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Aggressive mode is more secure than main mode

  Why it's wrong here

  Aggressive mode is not more secure than main mode; the opposite is true. Main mode uses a six-message exchange that lets both peers establish a Diffie-Hellman shared secret and create an encrypted channel before transmitting their identification payloads, so identities are protected. Aggressive mode sends the identity in the clear, as it has not yet established encryption keys. Thus, main mode is the security-hardened choice when identity privacy is a concern.

• ✓

  Aggressive mode transmits the identification in clear text

  Why this is correct

  In aggressive mode, the initiator sends its identification (IDi) along with the Diffie-Hellman values in the first packet, and the responder returns its identification (IDr) in the second packet. Because the shared secret is not yet computed when these packets are exchanged, no encryption keys exist, so the ID payloads are transmitted in plaintext. A passive attacker on the network path can capture these packets and directly read the identities of the VPN peers. This is the primary reason aggressive mode is considered insecure for identity protection.

• ✗

  Aggressive mode provides perfect forward secrecy (PFS) by default

  Why it's wrong here

  Perfect forward secrecy (PFS) is not an inherent attribute of aggressive mode or of any IKE Phase 1 mode; it is an independent configuration in the Phase 2 proposal. PFS forces a new Diffie-Hellman key exchange during each re-key, ensuring that compromising a single long-term key does not expose past session keys. Enabling PFS in the VPN settings is done separately and has no relation to whether main or aggressive mode is selected. Therefore, aggressive mode does not provide PFS by default.

• ✗

  Aggressive mode uses six messages instead of three

  Why it's wrong here

  Aggressive mode actually requires only three messages to complete IKE Phase 1: the initiator sends its proposal and DH data, the responder answers with the selected proposal and DH data, and the initiator confirms. This compact exchange reduces the number of round trips and makes aggressive mode faster, but it sacrifices identity protection because the identities are exposed in those early packets. The six-message exchange is characteristic of main mode, which separates the negotiation into a cryptographic proposal phase and an authenticated key exchange phase.

Go deeper

Related to this question