A network security administrator is designing an IPsec site-to-site VPN to interconnect a main office and a remote branch office across the Internet. Which TWO statements correctly describe the operational functions and behavior of IPsec framework protocols in this deployment?
- ESP in Tunnel mode encrypts the entire original IP packet and adds a new outer IP header for routing across public networks.Cevap
- ESP provides data confidentiality, data origin authentication, and connectionless integrity for IP packets.Cevap
- CAH provides data encryption for the packet payload while maintaining light protocol overhead.
- DAH allows seamless packet traversal through NAT devices because it ignores mutable outer IP header fields during integrity checks.
- ETransport mode encapsulates the original IP header inside a new outer IP header, making it ideal for site-to-site security gateways.
Cevap
The two correct statements are that ESP in Tunnel mode encrypts the entire original IP packet with a new outer IP header added, and that ESP provides data confidentiality, origin authentication, and integrity.
ESP (Encapsulating Security Payload) is the core IPsec protocol used when encryption is required. In Tunnel mode, ESP encapsulates and encrypts the complete original IP packet (header and payload) with ESP headers/trailers and prepends a new outer IP header. This provides data confidentiality, authentication, and integrity across public networks.
Adım Adım Çözüm
Anahtar Kavram
IPsec Framework Protocols (ESP vs. AH) and Encapsulation Modes (Tunnel vs. Transport)