A network engineer is attempting to design-in resiliency characteristics for an enterprise network's VPN services.
If the engineer wants to help ensure some resilience against zero-day vulnerabilities exploited against the VPN implementation, which of the following decisions would BEST support this objective?
Click on the arrows to vote for the correct answer
A. B. C. D.D.
The best approach to help ensure resilience against zero-day vulnerabilities exploited against VPN services would be to implement multiple layers of security. This approach is known as defense-in-depth and helps protect against a wide range of security threats.
Answer A suggests implementing a reverse proxy for VPN traffic that is defended and monitored by the organization's SOC. This approach can help protect against attacks on the VPN implementation, as all VPN traffic is first routed through the reverse proxy. Additionally, the SOC can monitor the reverse proxy for any potential attacks and alert administrators in near real-time.
Answer B suggests subscribing to a managed service provider capable of supporting the mitigation of advanced DDoS attacks on the enterprise's pool of VPN concentrators. While this can help protect against DDoS attacks, it may not be the most effective approach for protecting against zero-day vulnerabilities.
Answer C suggests distributing the VPN concentrators across multiple systems at different physical sites to ensure backup services are available in the event of primary site loss. While this approach can help provide redundancy, it may not be effective against zero-day vulnerabilities that can exploit the VPN implementation.
Answer D suggests employing a second VPN layer concurrently, where the other layer's cryptographic implementation is sourced from a different vendor. This approach can help protect against zero-day vulnerabilities that target a specific cryptographic implementation. If one implementation is compromised, the other layer can provide an additional layer of protection.
Therefore, option D would be the BEST decision to support the objective of ensuring some resilience against zero-day vulnerabilities exploited against the VPN implementation. However, it is important to note that implementing multiple layers of security is always the best approach to protect against security threats.