Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

An organization is deploying a secure remote access solution for traveling employees. The network security team specifies that the solution must encapsulate and encrypt all network-layer (Layer 3) IP traffic between host laptops and the central gateway, ensuring the original internal IP header is completely hidden while traversing the public Internet. Which protocol and deployment mode best satisfies these requirements?

  1. IPsec operating in Tunnel modeAnswer
  2. B
    IPsec operating in Transport mode
  3. C
    Clientless SSL/TLS portal access
  4. D
    Generic Routing Encapsulation (GRE) without security protocols

Answer

IPsec operating in Tunnel mode is the correct choice because it encapsulates and encrypts the complete original IP packet (both payload and original internal IP header), providing comprehensive Layer 3 confidentiality for client-to-gateway remote access over untrusted networks.
IPsec in Tunnel mode encrypts both the original IP payload and the original IP header, placing the encrypted packet inside a new IP packet with a gateway address as the destination. This completely hides internal network topology and secures all Layer 3 host traffic over untrusted networks.

Step-by-Step Solution

1
Analyze the core security and encapsulation requirements.
Determined that all Layer 3 IP traffic must be encrypted and the original internal IP header obfuscated during transmission across public routes.
Host-to-gateway remote access VPN solutions over public networks must prevent public routers from inspecting internal IP addresses.
2
Compare IPsec operational modes (Tunnel mode vs. Transport mode).
Tunnel mode creates a new outer IP header and encrypts the entire original IP packet, whereas Transport mode inserts security headers between the original IP header and payload without encrypting the original header.
Transport mode is intended for end-to-end host communication where intermediate routers need visibility into original IP headers, while Tunnel mode is designed for gateway-protected VPN connections.
3
Evaluate alternative remote access technologies (Clientless SSL/TLS and GRE).
Clientless SSL operates at the Application Layer restricting scope to browser sessions, while plain GRE encapsulates traffic without providing encryption.
Neither technology satisfies both full Layer 3 tunneling and native packet confidentiality requirements.

Key Concept

IPsec Tunnel Mode vs. Transport Mode for Remote Access VPNs
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic