Examkin

Soru

Zorluk: OrtaVirtual Private Networks and Remote Access Security

A security engineer is configuring a site-to-site Virtual Private Network (VPN) between two gateway routers across an untrusted public network. The mandate requires that the entire original IP packet—including both its header and payload—must be fully encrypted and encapsulated within a new outer IP header for gateway-to-gateway transit. Which IPsec operational mode and protocol combination must be deployed to satisfy these requirements?

  1. IPsec Tunnel mode using Encapsulating Security Payload (ESP)Cevap
  2. B
    IPsec Transport mode using Encapsulating Security Payload (ESP)
  3. C
    IPsec Tunnel mode using Authentication Header (AH)
  4. D
    IPsec Transport mode using Authentication Header (AH)

Cevap

IPsec Tunnel mode using Encapsulating Security Payload (ESP) is the correct choice because Tunnel mode encapsulates the complete original IP packet in a new IP header for site-to-site gateway transport, and ESP provides the required confidentiality through payload encryption.
IPsec Tunnel mode is designed for site-to-site security gateways. It encapsulates the entire original IP packet inside a new outer IP header. Encapsulating Security Payload (ESP) encrypts the inner packet payload, ensuring total confidentiality across untrusted networks.

Adım Adım Çözüm

1
Identify the required IPsec mode based on network architecture and header treatment.
Tunnel mode is required because the scenario calls for site-to-site encapsulation of the entire original IP packet (header + payload) inside a new outer IP header between gateway routers.
Transport mode only protects the IP payload and preserves the original IP header, making it suitable only for end-to-end host scenarios.
2
Identify the required IPsec security protocol based on cryptographic services needed.
Encapsulating Security Payload (ESP) is required because confidentiality (encryption) of the data is requested.
Authentication Header (AH) provides integrity and anti-replay protection but provides no encryption/confidentiality.
3
Combine the mode and protocol selection.
IPsec Tunnel mode + ESP fulfills both requirements: complete packet encapsulation for gateway transit and encryption for data privacy.
This combination forms the standard foundation for site-to-site IPsec VPN tunnels.

Anahtar Kavram

IPsec Modes (Tunnel vs. Transport) and Protocols (ESP vs. AH)
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru