Examkin

Question

Difficulty: MediumRemote Access and Site-to-Site VPN Concepts

A network security administrator is deploying a site-to-site IPsec VPN tunnel between two corporate edge routers across a private WAN. The security policy requires data confidentiality and integrity for the IP payload. To minimize encapsulation overhead, the design mandates retaining the original IP packet header rather than encapsulating the packet with an additional new IP header. Which IPsec protocol and mode combination fulfills these requirements?

  1. Encapsulating Security Payload (ESP) in transport modeAnswer
  2. B
    Authentication Header (AH) in transport mode
  3. C
    Encapsulating Security Payload (ESP) in tunnel mode
  4. D
    Authentication Header (AH) in tunnel mode

Answer

Encapsulating Security Payload (ESP) in transport mode
Encapsulating Security Payload (ESP) provides confidentiality through data encryption as well as data integrity and origin authentication. In transport mode, ESP encrypts only the IP payload while keeping the original IP header intact, satisfying both the security policy for confidentiality and the constraint to minimize packet overhead.

Step-by-Step Solution

1
Identify the protocol requirement for data confidentiality and integrity.
Encapsulating Security Payload (ESP) must be selected because Authentication Header (AH) does not support encryption (confidentiality).
AH provides integrity and authentication only, whereas ESP provides encryption, integrity, and authentication.
2
Determine the operational mode based on IP header overhead constraints.
Transport mode must be used rather than tunnel mode.
Transport mode encrypts only the payload and retains the original IP header, avoiding the extra overhead of adding a new outer IP header as required in tunnel mode.

Key Concept

IPsec Security Protocols (AH vs ESP) and Operational Modes (Transport vs Tunnel)
Rate this question

Topics

Remote Access and Site-to-Site VPN Concepts

More questions from this topic