Secure Communications and Network Attacks

The postcard network

Every network is a postcard machine. A message that travels in cleartext can be read by every device that carries it: the switch in the wiring closet, the router in the carrier’s building, the access point in the ceiling, the network taps and capture tools in between. The wire does not care who reads the traffic. Confidentiality is not a property of the cable. It is a property of the protocol you choose to run over it.

This chapter is about the two halves of that choice. The first half is secure communication: the protocols that seal the envelope. TLS seals web traffic, IPsec seals tunnels, SSH seals remote administration, DNSSEC seals name resolution, S/MIME and OpenPGP seal email, MACsec seals the physical link itself. The second half is the attack and countermeasure pairs: the ways an attacker breaks the seal or reads the postcard, and the control that closes each gap.

The exam does not ask you to configure any of these protocols. It asks you to reason about them. A question describes a network condition, an attacker action, or a design decision, and you choose the answer that restores the broken property. Almost every Domain 4 question reduces to one of two moves: match the threat to the property it attacks, or match the control to the property it restores. This chapter gives you both moves in pairs, so that when you see a question about ARP poisoning you reach for dynamic ARP inspection, and when you see a question about replay you reach for nonces and sequence numbers, not for a stronger cipher.

What a secure channel actually provides

A secure channel is a protocol that adds one or more properties to traffic that an untrusted network would otherwise not provide. There are four properties in play, and the exam expects you to name which one a protocol delivers and which one an attack destroys.

Confidentiality means the content cannot be read by anyone other than the intended parties. Encryption provides it. Integrity means the content cannot be changed without detection; a message authentication code or a signed digest provides it. Authentication of the peer means each side can prove it is talking to the claimed party, which in practice means verifying a certificate, a key, or a shared secret. Non-repudiation, the fourth, is narrower: the sender cannot later deny having sent a message, because the recipient can show a signature the sender produced. Non-repudiation belongs mostly to signing systems such as S/MIME and OpenPGP. Ordinary TLS does not give the server proof that the client sent something, and the exam will not pretend it does.

Two distinctions matter more than any detail of the protocols. First, encryption is not authentication. A channel can be encrypted with a key an attacker also knows, in which case it is confidential to bystanders but not trustworthy between the peers. Every serious protocol authenticates the key exchange, because an attacker who can substitute a key the victim trusts is an attacker who can decrypt and modify everything. Second, a secure channel protects its payload, not the whole world. TLS hides the HTTP request but leaves the IP addresses, the TCP ports, and the timing of the connection visible, which is why traffic analysis still works against encrypted traffic. IPsec tunnel mode goes further and hides even the inner IP header, but it still reveals the two gateway addresses. Understanding exactly what a protocol protects tells you what an attacker can still observe, and that observation is often the point of the exam question.

The same four properties recur at every layer. At the data link layer, MACsec (IEEE 802.1AE) encrypts and authenticates individual Ethernet frames on a point-to-point link. At the network layer, IPsec protects IP packets end to end. Above the transport layer, TLS protects the application payload, and DTLS (RFC 6347) does the same for datagram traffic that runs on UDP, such as WebRTC and some IoT protocols. At the application layer, SSH, S/MIME, and OpenPGP protect specific conversations. A network designed with defense in depth uses more than one: MACsec or IPsec to protect the transport path, TLS to protect the application payload, and signatures to prove origin. Each one protects a different envelope, and an attacker has to break all of them to learn anything useful.

TLS: the seal on the modern internet

Transport Layer Security is the most important secure channel in existence, because nearly everything people do on the internet runs through it. The current versions are TLS 1.2 (RFC 5246) and TLS 1.3 (RFC 8446). NIST SP 800-52 Rev. 2, the federal guidance for selecting TLS implementations, directs systems toward TLS 1.2 and 1.3, and the IETF has formally deprecated the older versions: RFC 8996 (2021) declares TLS 1.0 and 1.1 unsuitable for continued use. A security manager who finds a system still offering TLS 1.0 has a migration project, not a configuration preference.

TLS sits above the transport layer. It runs inside TCP, and it encrypts the application data that flows over the connection. The visible metadata, source and destination addresses, ports, packet sizes, and timing, stays visible, which is why a TLS inspection appliance or an on-path observer can still see who talks to whom and how much they exchange. What they cannot see is the content, unless the channel is deliberately terminated and re-encrypted by a trusted proxy, the model enterprise inspection appliances use.

The handshake is the part the exam cares about. In TLS 1.3, a full handshake takes one round trip. The client sends a ClientHello listing its supported protocol versions, cipher suites, and key exchange groups, and it includes a fresh key share. The server answers with a ServerHello, its certificate chain, its portion of the key exchange, and a finished message. From the two ephemeral key shares, both sides compute the same session keys without ever sending a usable secret across the wire. The client verifies the certificate chain before sending any protected data. A resumed connection can go even faster, with 0-RTT data on the first flight, at the cost of some replay exposure, which is why 0-RTT is used for idempotent operations and treated with caution.

Three TLS 1.3 design choices are exam-relevant. First, key exchange is always ephemeral: RSA key transport, where the server’s static private key could decrypt captured handshakes, was removed entirely. Every TLS 1.3 connection uses ephemeral Diffie-Hellman, which gives perfect forward secrecy. If the server’s private key is later stolen, previously captured sessions remain unreadable, because the ephemeral keys that protected them were discarded at the end of each connection. Second, all cipher suites in TLS 1.3 are AEAD constructions: a single mode, such as AES-GCM or ChaCha20-Poly1305, provides both confidentiality and integrity. The suites look like TLS_AES_128_GCM_SHA256: they name an AEAD cipher and a hash, and they no longer carry key exchange information, because key exchange is always the same ephemeral process. Third, the handshake itself is protected. The certificate and the server’s handshake messages are encrypted once the keys are established, and a downgrade sentinel prevents a man-in-the-middle from forcing both sides down to an older, weaker protocol.

TLS 1.2 is still in wide service and still appears on the exam. It supports more cipher-suite shapes, including RSA key transport and CBC-mode ciphers, which is precisely why older TLS 1.2 configurations are weak: a server that permits RSA key transport has no forward secrecy, and a server that permits CBC ciphers without modern protections is exposed to padding oracle attacks. The secure way to run TLS 1.2 is with ephemeral ECDHE or DHE key exchange and an AEAD cipher such as AES-GCM. The general principle, that ephemeral keys give forward secrecy and AEAD modes give combined confidentiality and integrity, transfers to TLS 1.2 configurations, to IPsec, and to every other protocol with a configurable key exchange.

The certificate layer is what makes TLS trustworthy rather than merely encrypted. Servers present X.509 certificates (RFC 5280), and the client validates them by walking the chain: the leaf certificate presented by the server is signed by an intermediate certificate, which is signed by a root certificate that the client’s trust store already knows. The root is the trust anchor; the client trusts the root by installation, and trusts everything beneath it by signature. Validation checks the signature, the validity dates, the host name in the certificate against the name the client requested, and whether the certificate has been revoked. Revocation status is checked through certificate revocation lists (CRLs, also defined in RFC 5280) or the Online Certificate Status Protocol (OCSP, RFC 6960), which answers the question “is this certificate still valid right now” with a signed response. When a certificate’s private key leaks, or an employee leaves and their code-signing key must be retired, revocation is the mechanism that makes the damage stop.

Because TLS authenticates the server but, in ordinary web use, not the client, an attacker who can control certificate validation can do anything the server can. That is the core of man-in-the-middle attacks against TLS: not breaking the cryptography, but tricking the client into trusting the attacker’s certificate. The countermeasures are the controls this chapter returns to repeatedly: validate the chain, validate the name, keep trust stores clean, and use HTTP Strict Transport Security (HSTS, RFC 6797) to force browsers to use HTTPS and to reject any attempt to fall back to cleartext.

IPsec: the tunnel that carries networks

Internet Protocol Security is the secure channel that lives at the network layer. Its architecture is defined in RFC 4301, and it has two data-plane protocols and one control-plane protocol. The two data-plane protocols are Authentication Header (AH, RFC 4302), which provides integrity and peer authentication but no confidentiality, and Encapsulating Security Payload (ESP, RFC 4303), which provides confidentiality and, in every modern deployment, integrity and authentication as well. In practice ESP is the workhorse; AH sees little use because it does not encrypt and it breaks across NAT in awkward ways. The control-plane protocol is IKE, the Internet Key Exchange, which negotiates the keys and the security associations the data plane will use. The current version, IKEv2, is defined in RFC 7296, and NIST SP 800-77 Rev. 1, the IPsec VPN guidance, recommends IKEv2 over the legacy IKEv1.

IPsec has two modes, and choosing between them is a classic exam distinction. In transport mode, IPsec protects the payload of the packet but leaves the original IP header in place. The endpoints of the IPsec association are the same hosts that are communicating, which makes transport mode the choice for direct host-to-host protection, for example a client talking to a server that terminates its own IPsec. In tunnel mode, the entire original IP packet, header included, is wrapped inside a new packet with new outer IP headers. The endpoints of the tunnel are gateways: a firewall or VPN concentrator that terminates the tunnel, unpacks the inner packet, and forwards it onto the internal network. Tunnel mode is the mode of site-to-site VPNs, and it is the mode that hides the inner addresses, because the inner header is encrypted inside the ESP payload. If a question describes two offices connected through the internet, the answer is tunnel mode with ESP.

The security association, the SA, is the negotiated bundle of state: the peers, the keys, the cipher, the lifetime, and the anti-replay window. IKE’s job is to establish SAs. In IKEv2 a single exchange produces an IKE SA used to protect further negotiations, then one or more child SAs, the ESP or AH SAs that carry the actual traffic. The key agreement uses Diffie-Hellman with fresh ephemeral values, which gives the same forward secrecy property TLS 1.3 has: a compromised long-term credential does not decrypt past sessions. IKE can authenticate peers with pre-shared keys, with certificates, or, in IKEv2, with EAP for remote-access scenarios. When the traffic traverses NAT, ESP’s protocol number is not carried by NAT devices, so the implementation falls back to UDP encapsulation of ESP, defined in RFC 3948, on UDP port 4500. IKE itself runs on UDP 500. The exam sometimes probes exactly these ports: 500 for IKE, 4500 for the NAT-traversal encapsulation.

VPNs: the tunnel as the office

A virtual private network is a business decision wearing a protocol. The purpose of a VPN is to make an untrusted transit network behave, from the endpoints’ point of view, like a trusted private segment. Two branches of an organization connect their offices over the internet, and the IPsec tunnel between the two gateway firewalls makes the two LANs appear adjacent. A remote employee on a hotel network opens a VPN client, authenticates, and is given an address on the corporate network, as if they had plugged into the office wall.

The exam distinguishes site-to-site and remote-access VPNs, and it expects you to know which protocol fits which. Site-to-site VPNs connect whole networks: the tunnel terminates on gateways at each end, and the hosts behind the gateways never see the cryptography. These are almost always IPsec in tunnel mode, and they are permanent infrastructure, negotiated once and kept alive. Remote-access VPNs connect an individual device to the network. They come in two flavors. An IPsec remote-access VPN runs a client on the user’s device and terminates at a concentrator, often with IKEv2 and EAP or certificate authentication. A TLS VPN, sometimes still called an SSL VPN (NIST SP 800-113 covers the design), rides inside HTTPS and comes in two forms: portal mode, where the user opens a browser, authenticates to a gateway, and reaches only the web applications the gateway publishes, and tunnel mode, where a small client (often a browser extension or a native app) forwards a broader set of traffic through the HTTPS connection. Portal mode is the lighter deployment: no client software, fine-grained application publishing, and browser-only access. Tunnel mode is closer to a full remote-access IPsec VPN, with a larger traffic surface.

The tunneling policy matters as much as the protocol. Split tunneling routes only corporate-destined traffic through the tunnel and sends everything else straight to the internet from the user’s local connection. It is convenient and cheap, and it is a security hazard: the split-tunneled traffic bypasses the corporate filtering, logging, and inspection stack, and a compromised endpoint can be used as a pivot into the corporate network while still having full internet access. Full tunneling routes all user traffic through the VPN headend, so every connection is subject to the same controls as an on-premises workstation. The security trade-off is real operational cost: the headend carries all the traffic. The exam wants the judgment: remote users with sensitive duties get full tunneling, and split tunneling is accepted only when its risks are understood and compensated.

A VPN extends trust; it does not create it. The remote endpoint, once admitted, sits on the trusted network, so the authentication of the endpoint matters as much as the encryption of the path. That is why production remote-access VPNs pair certificate or password authentication with multi-factor authentication, why they enforce device posture checks before admission, and why they are designed with redundancy: an active concentrator, a failover peer, and enough capacity that a tunnel failure does not strand the remote workforce. SP 800-77 Rev. 1 frames all of this as the IPsec VPN lifecycle: plan, design, implement, operate, monitor, and retire. The exam question will not ask for the lifecycle steps. It will ask you to recognize that the weakest part of the VPN is not the cipher but the endpoint and the policy around it.

Secure replacements for the rest of the stack

TLS and IPsec are not the only secure channels, and the exam expects you to know the standard replacements for the legacy cleartext protocols that still populate networks.

Remote administration runs on SSH. The SSH protocol family (RFC 4251 for the architecture, RFC 4253 for the transport) provides authenticated and encrypted command sessions on port 22, and it has effectively replaced Telnet (RFC 854), whose traffic is cleartext and whose authentication is a plain password. The exam contrast is blunt: Telnet sends everything readable by anyone on the path, SSH does not. The same logic covers file transfer: SFTP, which rides as a subsystem inside the SSH connection, and FTPS (FTP over TLS) replace plain FTP. Network management has the same story. SNMPv1 and SNMPv2c authenticate with community strings sent in cleartext, which is no authentication at all against anyone who can sniff. SNMPv3, defined in RFC 3411, adds the User-based Security Model (RFC 3414), with per-user authentication and encryption, and the View-based Access Control Model (RFC 3415), with fine-grained permission levels. A manager who finds SNMPv2c on the core switches has a hardening finding.

Name resolution has two complementary protections. DNSSEC (RFC 4033, RFC 4034, RFC 4035) gives DNS responses origin authentication and integrity: each zone’s records carry signatures from the zone’s DNSKEY, and a chain of trust runs from the root’s trust anchor down through delegated DS records to the leaf zone. DNSSEC proves that a response really came from the zone and was not altered in transit; it does not hide the queries. DNS over TLS (DoT, RFC 7858) and DNS over HTTPS (DoH, RFC 8484) do the hiding: they encrypt the queries between the stub resolver and the recursive resolver so that an on-path observer cannot read or modify them. The two protections are complementary, and the exam likes to force the distinction: DNSSEC answers “can I trust this response”, DoT and DoH answer “can anyone else see or change my queries”. The same split, authenticity versus transport confidentiality, runs through the whole chapter.

Email has two competing secure-messaging designs. S/MIME (RFC 8551) builds on X.509 certificates: senders sign and encrypt messages using CMS, and recipients validate signatures against the same certificate infrastructure the web uses. OpenPGP (RFC 4880) uses its own key format and a web-of-trust model in which users validate each other’s keys rather than relying on a central hierarchy. Both provide the same pair of properties: signatures for integrity, authenticity, and non-repudiation, and encryption for confidentiality. Voice and video have SRTP (RFC 3711), which encrypts and authenticates the RTP media stream used by SIP-based telephony. And at the link layer, MACsec (IEEE 802.1AE) encrypts and authenticates Ethernet frames on a point-to-point link, protecting everything that crosses a backbone link regardless of protocol, with keys typically derived through the 802.1X framework.

The pattern the exam wants you to see: every legacy cleartext protocol has a modern, encrypted, authenticated replacement, and the replacements all rest on the same small set of primitives, ephemeral Diffie-Hellman for forward secrecy, AEAD ciphers for combined confidentiality and integrity, and certificate or key-based authentication for identity. When you learn a new protocol, ask three questions: what does it encrypt, what does it authenticate, and what standard defines it. That habit answers most Domain 4 protocol questions without memorizing a single packet format.

The attacker’s position and the two questions

Network attacks are easier to classify than to prevent, and the classification is what the exam rewards. The first axis is passive versus active. A passive attacker listens: packet capture, sniffing, traffic analysis. They change nothing, so detection is hard and the countermeasure is prevention, above all encryption. An active attacker injects, modifies, deletes, or impersonates: they send forged ARP replies, spoofed packets, malicious DNS answers, crafted handshakes. Active attacks are detectable in principle, because they disturb the traffic they touch, and they are countered with authentication and integrity checks.

The second axis is position. An on-path attacker sits between the victim and the destination, which means the traffic physically or logically passes through equipment the attacker controls: a compromised switch, a rogue access point, a poisoned ARP cache, an intercepted DNS exchange. An off-path attacker cannot see the traffic but can send packets to either party, guessing or probing values such as TCP sequence numbers, DNS transaction IDs, or session tokens. Off-path attacks are the harder class, and they succeed only when the protocol leaks or predictably derives the values it should keep secret, which is why randomizing sequence numbers (RFC 1948) and transaction IDs is a security control, not a performance tweak.

Every attack breaks exactly one assumption of the channel. Sniffing breaks confidentiality. Spoofing and MITM break peer authentication. Replay breaks freshness. DNS poisoning breaks the integrity of the name-to-address binding. A SYN flood and an amplification attack break availability. So the reasoning pattern is a pair: name the property the attack destroys, then name the control that restores it. Encryption restores confidentiality. Authenticated key exchange and certificate validation restore peer authentication. Nonces, timestamps, and sequence numbers restore freshness. Signatures and message authentication codes restore integrity. Rate limiting, filtering, and redundancy restore availability. When a question gives you an attack, you pick the control that restores the broken property; when it gives you a control, you pick the attack whose property it restores.

Layer 2 pairs: the wire itself

The data link layer is the most intimate place an attacker can stand, because it is the layer of the network the victim physically shares. The attacks here are local, which means they require the attacker to be on the same switched segment, wireless cell, or wiring closet, but once there, the attacker is inside the trusted zone where the network itself expects honesty.

Sniffing is the base attack: a network interface in promiscuous mode captures frames, and any cleartext traffic on the segment is readable. Switched networks once seemed to end sniffing, because a switch forwards frames only to the right port, but every Layer 2 attack in this section is, in part, a way to make the switch hand the attacker someone else’s frames. The durable countermeasure is therefore encryption: MACsec for the links that must carry everything, TLS or IPsec for the payloads that cross untrusted segments, and 802.1X to decide, before a device can even speak, whether it is allowed on the port.

MAC flooding targets the switch’s forwarding table. The switch learns source MAC addresses and stores them in a content-addressable memory of finite size; an attacker floods thousands of forged source MACs until the table overflows, and the switch falls back to flooding frames out every port, effectively demoting itself to a hub and handing the attacker everyone’s traffic. The countermeasure is port security: configuring each switch port with a maximum number of learned MAC addresses and a violation action, so a flood of fake sources triggers the port to block or shut down. Port security also raises the cost of simply plugging in an unauthorized device.

ARP poisoning is the classic LAN man-in-the-middle. The Address Resolution Protocol (RFC 826) answers “which MAC address belongs to this IP address”, and the answer lives in a cache that any device on the segment can pollute with unsolicited replies. An attacker sends forged ARP replies claiming that the victim’s IP address maps to the attacker’s MAC, the victim’s traffic to the gateway flows through the attacker, and the attacker reads, modifies, and forwards it. Two controls work together: DHCP snooping, which builds a trusted table of which IP address belongs to which switch port from observed DHCP traffic, and Dynamic ARP Inspection, which validates every ARP message against that table and drops the forged ones. Static ARP entries on critical hosts and plain encryption (if the attacker gets the frames but not the keys, the poison yields nothing) are the backups. The exam pair is fixed: ARP poisoning is answered by DAI plus DHCP snooping, or by the honest recognition that encryption renders the sniffed traffic unreadable.

VLAN hopping attacks the segmentation itself. In the switch-spoofing variant, an attacker uses the Dynamic Trunking Protocol, DTP, to negotiate a trunk link with the switch, after which the attacker’s port carries traffic for every VLAN on the trunk. In the double-tagging variant, the attacker sends a frame with two 802.1Q tags; the access switch strips the outer tag and forwards the frame, inner tag intact, onto a trunk, where the receiving switch reads the inner tag and delivers the frame into the wrong VLAN. The countermeasures are configuration discipline: disable DTP and set ports to static access mode, never auto-trunk user ports, and drop frames on access ports that carry 802.1Q tags. Segmentation is only as real as the switch configuration that enforces it.

Spanning-tree attacks target the loop-prevention protocol. The spanning tree protocol elects a root bridge and blocks redundant ports; an attacker who sends superior BPDUs can be elected root, after which traffic that was engineered to flow across specific links instead flows through the attacker’s port. BPDU guard shuts down a port the moment it receives a BPDU, which is exactly the right behavior on an access port, and root guard refuses to accept superior BPDUs on designated links. Both are switch features, not new protocols, and the exam treats them as the standard pair for spanning-tree abuse.

One more Layer 2 discipline belongs in every pair: MAC address spoofing, where an attacker claims a trusted device’s MAC to defeat MAC-based allowlists or to inherit its traffic. The robust answer is not to trust MAC addresses at all, but to authenticate the device with 802.1X and EAP, so admission is decided by credentials and certificates, not by a 48-bit number anyone can forge.

Layer 3 and 4 pairs: packets and connections

Above the local segment, the attacker faces the network layer and the transport layer, where packets carry source and destination addresses that anyone can stamp and connections carry state that everyone assumes.

IP spoofing is the base deception: an attacker sends packets whose source address is someone else’s. Spoofing alone does nothing useful, which is why it is always a component of a bigger attack: spoofed sources make amplification and reflection attacks possible, spoofed addresses impersonate trusted hosts, and spoofed replies feed session hijacking. The countermeasure is filtering at the border. RFC 2827, published as BCP 38, established the practice of ingress filtering: the edge router drops any packet whose source address does not belong to the address space of the network it came from. BCP 84 (RFC 3704) extends the practice to multihomed networks, and unicast reverse-path forwarding (uRPF) automates the check by verifying that the packet arrived on the interface the source address would use to leave. A network that filters spoofed sources starves every downstream attack that depends on them.

ICMP abuse has two classic forms. The smurf attack sent ICMP echo requests to a directed broadcast address with the victim’s address as the source, turning every host on the segment into a reflector; RFC 2644 (1999) changed the default so routers no longer forward directed broadcasts, which largely retired the technique. ICMP redirect messages, which a router uses to tell a host about a better route, can be forged to steer traffic through an attacker; hosts should ignore unsolicited redirects. Ping floods and ICMP-based tools are handled with rate limiting and, for the routing infrastructure, by filtering ICMP that no operational need requires.

SYN floods attack the statefulness of TCP itself. The three-way handshake requires the server to hold a half-open connection for every received SYN while it waits for the ACK that completes the handshake; an attacker sends SYNs with spoofed source addresses and never completes them, and the backlog of half-open connections exhausts the server’s memory or its listen queue, blocking legitimate connections. The countermeasures are defensive engineering: SYN cookies, which make the handshake stateless by encoding the connection state in the server’s sequence number so the server stores nothing until the ACK arrives; shorter handshake timeouts; and rate limiting on new connections. SYN cookies are the exam’s canonical answer for SYN floods, and it is worth knowing why they work: they move the cost of the attack from the server’s memory to the attacker’s need to complete the handshake honestly.

Amplification and reflection attacks are the modern denial-of-service engine. The recipe has three ingredients: a UDP service that answers a small query with a large response, an open instance of that service somewhere on the internet, and spoofed packets. The attacker sends small queries with the victim’s IP as the source; the reflectors, which include open DNS resolvers, NTP servers, and other UDP services, send their large responses to the victim, and the attacker’s traffic cost is multiplied by the amplification factor of the service. DNS-based amplification is the classic example, and the mitigation stack is layered: ingress filtering (BCP 38) so spoofed packets never reach the reflectors, closing or rate-limiting open resolvers, anycast deployment that spreads the load, and a DDoS mitigation service that scrubs the attack traffic in the provider network before it reaches the victim.

Session hijacking targets the connection state itself. An off-path attacker who can predict or observe the TCP sequence numbers of an established connection can inject data into it, and a hijacked session can be steered, poisoned, or taken over outright. The countermeasures are randomization and encryption: random initial sequence numbers (RFC 1948 formalized the need after the original TCP specification was found vulnerable to sequence prediction), and encryption of the session so that the values an attacker would need are never observable. At the application layer, session tokens deserve the same treatment: random, short-lived, bound to the session, and re-validated for sensitive actions.

Port scanning is reconnaissance, not attack, but the exam pairs it with a defensive posture. A scanner discovers what is open; the defense is to have as little as possible to discover. Firewalls implement deny-by-default filtering (NIST SP 800-41 Rev. 1 is the firewall guidance), intrusion detection and prevention systems watch for scan patterns (NIST SP 800-94), and hardening reduces listening services to the minimum the business needs. The manager’s view: a network that answers scanning with silence, except where traffic is expected, has removed the attacker’s cheapest information.

DNS pairs: the name layer

DNS is the network’s trust boundary in disguise. Every host on the internet starts almost every interaction with a DNS query, and the answer determines where the traffic goes. Attackers who can influence that answer do not need to break TLS; they just redirect the victim to a server they control, where the TLS certificate check becomes the only thing standing between them and the traffic.

DNS cache poisoning plants false answers in a resolver’s cache. A resolver asks a question, an attacker gets there first, or manipulates the exchange, and the resolver caches an answer that maps a legitimate name to an attacker-controlled address. Pharming is the user-facing consequence: a victim types the bank’s real address and lands on a look-alike site. The countermeasures are layered. DNSSEC (RFC 4033, RFC 4034, RFC 4035) is the fundamental fix, because signed responses make a forged answer fail validation; resolvers also randomize the source port and transaction ID of every query so that a guesser cannot predict them, and modern resolvers apply bailiwick checks that refuse out-of-zone answers. For the last mile between the user’s device and the resolver, DoT (RFC 7858) and DoH (RFC 8484) encrypt the queries so an on-path attacker cannot read or alter them. The exam pair is precise: cache poisoning is answered by DNSSEC, and query snooping or last-mile tampering is answered by DoT or DoH.

DNS tunneling turns the name system into a covert channel. Attackers encode data in the labels of DNS queries (a query for exfiltration-data.attacker.example carries bytes out) and in DNS responses (a malicious authoritative server answers with a payload that carries commands or stolen data in). DNS is an attractive vehicle because it is almost never blocked; firewalls that drop everything else still let DNS reach the resolver. The countermeasures are visibility and egress discipline: monitor DNS for unusual query volume, long labels, or unknown domains (techniques NIST SP 800-81 guidance on DNS operations supports), filter egress DNS so only sanctioned resolvers are reachable, and treat DNS logs as a source for data-loss detection.

Channel pairs: MITM, stripping, replay

The attacks in this section target the secure channel itself, and they are the ones the exam most wants you to reason through, because they separate the candidate who understands the property from the candidate who only knows the acronym.

Man-in-the-middle, MITM, is the general class: the attacker sits on the path and relays or alters traffic between two parties who believe they are speaking directly. Every MITM attack is, underneath, a failure of peer authentication. The victim trusts the wrong key, the wrong certificate, or the wrong endpoint, and the attacker becomes the trusted party. The countermeasures are therefore the authentication machinery of the protocols themselves: validate certificate chains and host names, use authenticated key exchanges such as TLS with ephemeral Diffie-Hellman or IKEv2, require mutual authentication where both sides are sensitive, and keep the trust stores that the validation depends on clean and current. An attacker cannot MITM a channel whose endpoints authenticate each other with keys they can prove they hold.

SSL stripping is the MITM that kills TLS without breaking it. The attacker, on the path, rewrites the secure elements of a page so that the victim’s browser requests the plaintext version: links pointing at https become http, redirects to HTTPS are removed, and the victim browses the site in cleartext while the attacker reads everything. The countermeasure is HSTS (RFC 6797): the server tells the browser, via a Strict-Transport-Security header, that the domain may only be accessed over HTTPS, the browser remembers this for a specified period, and it refuses to make a cleartext request to that domain, no matter what the attacker’s page says. HSTS is why the exam question about preventing SSL stripping has exactly one right answer.

Replay attacks send captured legitimate traffic again. A captured authentication exchange, a captured command, a captured payment authorization: if the recipient cannot tell that this message is a copy of an old one, the replay is indistinguishable from a new legitimate message. The countermeasures are freshness mechanisms: nonces (random values issued per transaction that the response must echo), timestamps with acceptance windows, monotonically increasing sequence numbers, and per-session keys so that a captured message from last session is meaningless in this one. IPsec ESP carries a sequence number and an anti-replay window that drops packets with old sequence numbers; TLS handshakes use fresh random values so each session’s keys are unique. The exam pair is fixed: replay is defeated by freshness, not by stronger encryption.

Downgrade attacks sit between the versions: the attacker forces both sides to negotiate the weakest protocol they both support, then attacks the weakness. TLS 1.3 defends its own handshake with the downgrade sentinel, and RFC 8996’s deprecation of TLS 1.0 and 1.1 is, in security terms, the elimination of a downgrade target: a server that no longer offers the old versions cannot be negotiated down to them. The operational rule is to disable legacy protocols and weak ciphers at the configuration level, so that no negotiation can land on them. The exam wants the judgment, not the flag names: protocol floors are security controls.

Wireless pairs: the medium that invites its own attacker

Wireless networks inherit every attack in this chapter and add attacks of their own, because radio is a medium that cannot be locked in a closet and because the access point, not the cable plant, is the boundary the attacker actually sees.

The rogue access point is an unauthorized AP plugged into the wired network, offering a back door past the perimeter. The evil twin is its impersonation cousin: an AP that broadcasts the legitimate network’s SSID, or something near it, to harvest credentials and traffic. The countermeasures are the same family in both cases: wireless intrusion prevention systems that detect unknown APs and deauth them, regular site surveys, wired-port controls (802.1X on the physical ports, so nothing unauthenticated gets onto the wired LAN in the first place), and, for the clients, enterprise authentication: 802.1X with EAP-TLS or another certificate-based EAP method, so clients validate the network and the network validates clients, and a rogue or twin AP without the right certificate cannot impersonate either side.

Deauthentication floods abuse the management frame. A client can be disassociated by a spoofed deauth frame, and an attacker who can do that at will can force a victim off the network and into a trap AP, or simply deny service. The fix is management frame protection, defined in IEEE 802.11w: authenticated management frames, so only the real AP can disassociate its clients. The exam pair is deauth floods to 802.11w.

The KRACK attacks of 2017 targeted the WPA2 four-way handshake itself, reinstalling a previously used key during the handshake and allowing decryption and injection. The response was patches for clients and APs, and the structural answer is WPA3, the Wi-Fi Alliance standard whose personal mode uses the SAE handshake, standardized in the IEEE 802.11 family, which does not permit the key reinstallation the attacks exploited. Enterprise networks with 802.1X were largely insulated, because the per-session key material comes from the EAP exchange rather than the four-way handshake alone. The general lesson is the exam’s favorite kind: authentication handshakes are security code, they get attacked, and the defense is patching plus modern handshakes, not faith in the brand of Wi-Fi.

Jamming is the oldest wireless attack: noise on the channel that denies service. There is no encryption answer; the countermeasures are detection (observe the channel, notice the anomaly), physical security (keep the antennas out of reach), and resilience (redundant paths, cellular failover, and business continuity plans for the coverage gap). Bluetooth adds its own pairs, bluejacking (unsolicited messages) and bluesnarfing (data theft through pairing and OBEX flaws), countered by disabling radios when unused, keeping devices non-discoverable, and patching.

Denial of service at scale

Every pair so far assumes an attacker who wants to read or alter traffic. A denial-of-service attack wants only to stop it, and it is the one attack class whose countermeasure is not a protocol but a posture.

The scalable forms are botnets, networks of compromised devices that deliver coordinated floods, and application-layer attacks that exploit server logic rather than bandwidth. Slowloris is the canonical example of the latter: the attacker opens hundreds of legitimate-looking HTTP connections and sends each request one byte at a time, or never finishes it, so the server’s connection pool fills with half-open requests and real users get nothing. The mitigation stack for application floods is a reverse proxy with strict read and connection timeouts, connection rate limiting, and a web application firewall (the OWASP community guidance covers the pattern); for the bandwidth floods it is ingress filtering, anycast distribution, capacity, and a scrubbing service that absorbs the attack in the provider network. The exam’s manager view: DDoS resilience is designed before the attack, tested in exercises, and owned jointly with the provider, because the network can no more defend a single-site origin alone than a building can defend a flood alone.

How the exam thinks about secure communication

Domain 4 questions are decision questions, and the decision logic has a consistent shape. Read the scenario, name the property that is being violated, and choose the answer that restores it. Encryption answers confidentiality threats, whether the threat is a sniffer, an evil twin, or a hotel network. Authentication answers impersonation threats, whether the impersonator is a rogue AP, a poisoned ARP cache, or a fake certificate. Freshness answers replay. Signatures and message authentication codes answer integrity. Filtering, rate limits, and redundancy answer availability.

Two habits separate a strong candidate from a memorizer. First, prefer prevention at the earliest sensible layer: a question that offers both a detection control and a prevention control will reward the prevention, all else equal, and a question that offers encryption as the answer to an eavesdropping threat will beat a monitoring tool, because the monitor still lets the data be read. Second, respect defense in depth: the best answer is often the one that works even when the other layer fails, which is why the honest answer to “how do we stop ARP poisoning from exposing data” can be “encrypt the traffic, so the poisoned frames reveal nothing”. When two controls both plausibly stop an attack, the exam expects you to prefer the one that restores the property the attack actually destroyed, at the layer the attack actually touched.

The final judgment is business judgment, and it is always in the question stem. A VPN is chosen for remote workers and branches; a TLS VPN portal for third parties who need a few applications; full tunneling for sensitive duties; site-to-site IPsec for offices. An attack that would cost the organization real money gets the layered defense; an attack that costs nothing gets a proportionate control. The manager who passes this domain is the one who answers, for every scenario, the question underneath the question: what property is at risk, and what does the business lose if it fails.

Practice questions

1. A server’s private key is stolen in a breach. The organization’s web traffic runs over TLS 1.3 (RFC 8446). Which property limits what the thief can do with TLS sessions that were captured before the breach?

A. Certificate revocation, because the CA can invalidate the key B. Perfect forward secrecy, because each session used ephemeral keys that were discarded C. Non-repudiation, because the server can prove what it sent D. Key escrow, because the recovery service retains the session keys

2. Which statement correctly describes cipher suites in TLS 1.3 (RFC 8446)?

A. Each suite names an AEAD cipher and a hash, and every key exchange uses ephemeral parameters, so forward secrecy is mandatory B. Each suite names a key exchange method, and RSA key transport remains the default C. Each suite combines a CBC cipher with an RSA signature, and the server chooses the weakest option D. Each suite is defined by the IETF and can only be used inside government networks

3. A legacy application only supports TLS 1.0. A security manager must decide how to handle it. Which response best aligns with current standards?

A. Keep TLS 1.0 enabled but limit it to internal users B. Treat TLS 1.0 as deprecated (RFC 8996) and plan the migration of the application to TLS 1.2 or 1.3 C. Add a stronger cipher to the TLS 1.0 configuration and continue D. Use TLS 1.0 only for non-sensitive pages

4. A browser validates a server’s certificate during a TLS handshake. Which component is the trust anchor for the validation?

A. The leaf certificate presented by the server B. The root certificate stored in the client’s trust store C. The certificate chain issued by the intermediate CA D. The OCSP responder operated by the server’s vendor

5. A web application must stop attackers from stripping HTTPS from a user’s session and reading the traffic. Which control is the direct countermeasure?

A. DNSSEC, so the name resolves to the real server B. HSTS (RFC 6797), so the browser refuses cleartext connections to the domain C. MACsec on the server’s uplink D. SNMPv3 on the load balancer

6. Two branch offices connect over the internet with an IPsec VPN between their gateway firewalls. Which IPsec mode fits this design, and why?

A. Transport mode, because it protects the payload with minimal overhead B. Tunnel mode, because the gateways encapsulate whole packets for delivery between networks C. AH only, because it encrypts the entire packet D. IKE without ESP, because the gateways do not need confidentiality

7. Which statement correctly distinguishes AH and ESP in IPsec (RFC 4302, RFC 4303)?

A. AH provides confidentiality; ESP provides only authentication B. ESP provides confidentiality and integrity; AH provides integrity and authentication without confidentiality C. AH encrypts the IP payload; ESP authenticates only the outer header D. ESP and AH are interchangeable modes of the same protocol

8. An IPsec VPN is being configured, and an engineer explains that a protocol first negotiates keys and security associations, then the data plane encrypts traffic. Which protocol performs the negotiation?

A. IKE (RFC 7296) B. TLS (RFC 8446) C. RADIUS (RFC 2865) D. ARP (RFC 826)

9. An IPsec tunnel must pass through a NAT device that does not carry the ESP protocol number. Which encapsulation and port pair supports this traversal?

A. ESP encapsulated in UDP on port 4500 (RFC 3948) B. ESP encapsulated in TCP on port 500 C. ESP encapsulated in GRE on port 1723 D. AH over UDP on port 853

10. A remote-access VPN is configured so that only corporate-destined traffic enters the tunnel, and everything else goes straight to the internet. What is the security implication of this design?

A. Split tunneling, so internet-bound traffic bypasses the corporate security controls B. Full tunneling, so every byte is inspected twice C. Transport mode, so the tunnel cannot carry web traffic D. Always-on VPN, so the endpoint is unreachable

11. A contractor needs browser-only access to two internal web applications from a laptop that cannot be managed or given a VPN client. Which VPN form fits the requirement?

A. An IPsec site-to-site tunnel B. A TLS VPN in portal mode, which publishes the specific applications through HTTPS C. A transport-mode ESP association between the laptop and every app server D. An open wireless hotspot on the internal network

12. A network administrator still uses Telnet (RFC 854) to configure switches. Which replacement best improves security?

A. TFTP for configuration transfer B. SSH (RFC 4251), which provides encrypted and authenticated remote sessions C. SNMPv1 with community strings D. HTTP with basic authentication

13. A network manager finds SNMPv2c community strings in cleartext traffic. Which version and feature is the correct replacement?

A. SNMPv3 (RFC 3411) with the User-based Security Model (RFC 3414), which provides per-user authentication and encryption B. SNMPv1 with a longer community string C. SNMPv2c with encrypted community strings D. SNMPv4 with a central password server

14. An analyst wants to prove that DNS responses were genuinely produced by the authoritative zone and not altered in transit. Which mechanism provides that property?

A. DNSSEC (RFC 4033), which signs zone records and validates them through a chain of trust B. DNS over HTTPS (RFC 8484), which encrypts the queries C. IPsec transport mode, which encrypts the resolver link D. A larger TTL on cached records

15. An organization wants to prevent an on-path observer from reading or modifying DNS queries sent from laptops to the corporate resolver. Which control addresses this threat?

A. DNSSEC, because it hides the queries B. DNS over TLS (RFC 7858) or DNS over HTTPS (RFC 8484), because they encrypt the query exchange C. Increasing the DNS cache TTL D. IP spoofing filters at the edge

16. Which statement correctly compares S/MIME and OpenPGP for email security?

A. S/MIME (RFC 8551) relies on X.509 certificates and a CA hierarchy; OpenPGP (RFC 4880) uses its own key format and a web of trust B. S/MIME encrypts only; OpenPGP signs only C. S/MIME uses a web of trust; OpenPGP requires a root CA D. Both protect email only while it is stored on the server

17. An engineer wants to encrypt and authenticate every frame crossing a point-to-point backbone link, regardless of protocol. Which control operates at the data link layer for this purpose?

A. MACsec (IEEE 802.1AE) B. TLS in tunnel mode C. DNSSEC D. SNMPv3

18. An attacker on a LAN sends forged ARP replies so that traffic intended for the default gateway is delivered to the attacker instead. Which control directly prevents the poisoning?

A. Dynamic ARP Inspection, which validates ARP messages against the DHCP snooping binding table B. BPDU guard, which blocks the port on BPDU receipt C. DNSSEC, which signs the ARP responses D. HSTS, which forces secure connections

19. An attacker floods a switch with forged source MAC addresses until its forwarding table overflows, causing the switch to broadcast all frames. Which control stops this attack?

A. Port security, which limits the number of MAC addresses a port can learn B. SYN cookies on the switch C. Unicast reverse-path forwarding D. OCSP stapling

20. A user port on a switch is configured to negotiate a trunk link dynamically. Which attack does this enable, and which configuration closes it?

A. VLAN hopping through switch spoofing; disable DTP and configure the port as static access B. MAC flooding through ARP; enable port mirroring C. Spanning-tree election through BPDUs; enable root guard D. Session hijacking through ISN prediction; randomize sequence numbers

21. An attacker sends superior BPDUs to be elected the spanning-tree root and redirect traffic through an attacker-controlled port. Which control disables the port when it receives a BPDU?

A. BPDU guard B. Dynamic ARP Inspection C. DHCP snooping D. HSTS

22. A network operator wants to prevent packets with forged source addresses from entering the network at the border. Which practice and standard is the direct countermeasure?

A. Ingress filtering as established by RFC 2827 (BCP 38) B. Encryption of the border links with MACsec C. Randomization of TCP sequence numbers D. Restricting SSH to management VLANs

23. A web server is overwhelmed by TCP connections that never complete the three-way handshake, exhausting its half-open connection table. Which mechanism is the canonical countermeasure?

A. SYN cookies, which make the handshake stateless until it completes B. BPDU guard, which drops the offending frames C. DNSSEC validation, which filters the sources D. Port security, which limits learned MAC addresses

24. An attacker sends small UDP queries with a spoofed source address to open resolvers, which respond with much larger messages to the victim. Which statement correctly describes this attack and its countermeasures?

A. An amplification and reflection DDoS; mitigated with ingress filtering against spoofing, closing open resolvers, and DDoS scrubbing B. A SYN flood; mitigated with SYN cookies C. A DNS tunneling attack; mitigated with egress filtering of DNS D. A smurf attack; mitigated with directed-broadcast filtering alone

25. A user in an airport connects to a Wi-Fi network that broadcasts a legitimate company’s SSID. After connecting, traffic to the company’s site fails and the user’s credentials are later abused. Which control would have prevented the credential theft?

A. Enterprise authentication with 802.1X and a certificate-based EAP method, so only the genuine network can authenticate B. A stronger PSK on the WPA2 network C. HSTS on the user’s browser D. BPDU guard on the access point

Answers and rationales

1. B. Perfect forward secrecy. TLS 1.3 uses ephemeral key exchange for every session, so the session keys are derived from ephemeral values discarded at session end. Stealing the long-term private key later does not reconstruct them. Revocation (A) stops future trust, not past sessions. Non-repudiation (C) concerns proof of origin. Key escrow (D) is a separate design that would only weaken the property.

2. A. TLS 1.3 cipher suites name an AEAD cipher and a hash (for example TLS_AES_128_GCM_SHA256), and key exchange is always ephemeral, which makes forward secrecy mandatory. RSA key transport and CBC modes were removed in RFC 8446, which eliminates B and C, and the IETF restriction in D is false.

3. B. TLS 1.0 is formally deprecated by RFC 8996, and NIST SP 800-52 Rev. 2 directs deployments toward TLS 1.2 and 1.3. Keeping the legacy version anywhere, even internally or on non-sensitive pages, preserves a downgrade target; the correct response is migration.

4. B. Validation walks the chain from the leaf through intermediates to a root that is already in the client’s trust store. The root is the trust anchor: the client trusts it by installation. The leaf (A) is what is being validated, not what anchors it. The OCSP responder (D) reports status; it does not anchor trust.

5. B. HSTS (RFC 6797) makes the browser refuse cleartext connections to the domain, which is precisely the countermeasure to SSL stripping. DNSSEC (A) authenticates name resolution but does not force HTTPS on a browser that has already been redirected. MACsec (C) and SNMPv3 (D) protect different layers and do not reach the user’s browser.

6. B. Site-to-site VPNs use IPsec tunnel mode, where gateways encapsulate whole packets inside new packets with their own addresses. Transport mode (A) protects the payload of a direct host-to-host connection. AH (C) does not encrypt, and IKE without ESP (D) negotiates keys but carries no protected traffic.

7. B. ESP provides confidentiality and integrity; AH provides integrity and authentication but no confidentiality. The other options reverse the capabilities or claim interchangeability, which is false: AH cannot substitute for ESP when confidentiality is required.

8. A. IKE (RFC 7296) negotiates the SAs and keys that ESP and AH then use. TLS (B) protects application data, RADIUS (C) is an authentication protocol, and ARP (D) resolves addresses on a local segment.

9. A. RFC 3948 defines UDP encapsulation of ESP on port 4500 for NAT traversal. Port 500 (B) is IKE’s port, 1723 (C) is PPTP-era GRE, and 853 (D) is DNS over TLS. AH (D) cannot traverse NAT because it authenticates the outer header.

10. A. Routing only corporate-destined traffic through the tunnel is split tunneling, and its security implication is that all other traffic bypasses the corporate inspection, filtering, and logging stack. Full tunneling (B) is the opposite design. Transport mode (C) and always-on (D) are unrelated to the routing policy described.

11. B. A TLS VPN in portal mode publishes specific applications over HTTPS with no client installation, which fits an unmanaged third-party laptop. Site-to-site IPsec (A) connects networks, not a single laptop’s application access. Transport-mode ESP (C) requires client-side IPsec and per-server associations, and (D) is not a VPN at all.

12. B. SSH (RFC 4251) provides encrypted, authenticated remote sessions and is the standard replacement for Telnet, whose traffic and password are cleartext. TFTP (A) is an unauthenticated file-transfer protocol, SNMPv1 (C) sends community strings in cleartext, and HTTP basic authentication (D) sends credentials in a trivially decoded header.

13. A. SNMPv3 (RFC 3411) with the User-based Security Model (RFC 3414) provides per-user authentication and encryption. Longer community strings (B, C) do not fix cleartext, and there is no SNMPv4 (D).

14. A. DNSSEC signs zone records and validates them through the chain of trust, which proves origin and integrity of responses. DoH (B) encrypts the query exchange but does not authenticate the zone. IPsec (C) protects transport, not the name-to-address binding, and TTL (D) affects caching, not authenticity.

15. B. DoT (RFC 7858) and DoH (RFC 8484) encrypt the query between client and resolver, so an on-path observer cannot read or alter it. DNSSEC (A) authenticates responses but leaves queries visible, which is the exact property this question tests. TTL (C) and spoofing filters (D) do not address the last-mile exchange.

16. A. S/MIME (RFC 8551) builds on X.509 certificates and a CA hierarchy; OpenPGP (RFC 4880) uses its own key format and a web of trust. The other options invert the models or misstate the capabilities: both provide signing and encryption.

17. A. MACsec (IEEE 802.1AE) encrypts and authenticates Ethernet frames at the data link layer on a point-to-point link, protecting all protocols that cross it. TLS (B) operates above transport, DNSSEC (C) protects DNS records, and SNMPv3 (D) manages devices.

18. A. Dynamic ARP Inspection validates ARP messages against the DHCP snooping binding table and drops the forged replies. BPDU guard (B) is for spanning-tree frames. DNSSEC (C) does not cover ARP, and HSTS (D) protects web sessions.

19. A. Port security caps the number of MAC addresses a port can learn, so a flood of forged sources triggers the violation action instead of overflowing the forwarding table. SYN cookies (B) are a TCP countermeasure, uRPF (C) addresses spoofed IP sources at the border, and OCSP (D) checks certificate status.

20. A. Dynamic trunk negotiation (DTP) enables switch-spoofing VLAN hopping; disabling DTP and pinning the port to static access mode closes it. MAC flooding (B) is a forwarding-table attack, BPDU-based root election (C) is answered by BPDU guard, and ISN prediction (D) is a TCP attack.

21. A. BPDU guard shuts down a port when a BPDU arrives, which is the correct response on an access port. DAI (B) and DHCP snooping (C) are ARP controls. HSTS (D) is a web control.

22. A. RFC 2827 (BCP 38) established ingress filtering: the border drops packets whose source address does not belong to the originating network. MACsec (B) protects link content, sequence number randomization (C) defends against session hijacking, and SSH restrictions (D) concern management access.

23. A. SYN cookies make the server stateless until the handshake completes, so the half-open table cannot be exhausted by a flood of incomplete handshakes. BPDU guard (B), DNSSEC (C), and port security (D) address other layers and attacks.

24. A. Small queries to open UDP reflectors that produce large responses to a spoofed victim address are amplification and reflection DDoS. The mitigation stack is ingress filtering against spoofed sources, closing or rate-limiting open resolvers, and scrubbing services. SYN cookies (B) answer SYN floods, egress DNS filtering (C) answers DNS tunneling, and smurf (D) is a directed-broadcast ICMP attack.

25. A. Enterprise authentication with 802.1X and a certificate-based EAP method means the client will only complete authentication with a network that presents the valid credentials, which defeats both the evil twin and the rogue AP scenario described. A stronger PSK (B) still lets a twin AP broadcast the SSID and capture handshakes. HSTS (C) and BPDU guard (D) are unrelated to wireless authentication.

Secure communication on one page

The channel layer, and the protocol that seals it:

The attack and countermeasure pairs:

The reasoning loop for every question: name the property at risk (confidentiality, integrity, authentication, freshness, availability), then choose the control that restores it at the layer the attack touches. Encryption for reading, authentication for impersonation, freshness for replay, signatures for tampering, filtering and resilience for denial. A secure network is not one that owns better hardware; it is one where every postcard that matters is sealed, every seal is checked, and every checked seal is backed by a second one.