Cisco CCNA 200-301 IPsec VPNs Practice Test

Topic 35 focuses on IPsec VPNs for the Cisco Certified Network Associate (CCNA) certification and the 200-301 exam, using Cisco networking and Cisco IOS concepts where relevant. For broader exam preparation, review the Cisco CCNA 200-301 Exam Dumps page. Each question includes a concise explanation of the correct answer and the technical reason the other choices are incorrect.

Question 1

Which VPN securely connects two networks through gateways, typically without individual users starting the tunnel manually?

1. Tunnel mode
2. Site-to-site VPN
3. Integrity
4. AH

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Incorrect Answers

Answer A is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer C is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer D is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

 

Question 2

Which VPN securely connects an individual user or endpoint to a private network over an untrusted network?

1. IKE
2. Transport mode
3. Remote-access VPN
4. AH

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Incorrect Answers

Answer A is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Answer B is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer D is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

 

Question 3

Which protocol family is used by IPsec to negotiate security associations and establish cryptographic parameters and keys?

1. Integrity
2. Peer authentication
3. ESP
4. IKE

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Incorrect Answers

Answer A is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer B is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

Answer C is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

 

Question 4

Which IPsec protocol can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic?

1. Remote-access VPN
2. ESP
3. AH
4. IKE

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Incorrect Answers

Answer A is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer C is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Answer D is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

 

Question 5

Which IPsec protocol provides integrity and authentication but does not encrypt the protected payload?

1. AH
2. Remote-access VPN
3. Tunnel mode
4. Encryption

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Incorrect Answers

Answer B is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer C is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer D is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

 

Question 6

Which transformation protects VPN data confidentiality from unauthorized readers?

1. AH
2. ESP
3. Remote-access VPN
4. Encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes the transformation that protects VPN data confidentiality from unauthorized readers.

Incorrect Answers

Answer A is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Answer B is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer C is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

 

Question 7

Which security property allows a receiver to detect whether protected data was altered in transit?

1. Tunnel mode
2. Peer authentication
3. Integrity
4. IKE

Correct Answer: C

 

Correct Answer

Answer C is correct because the selected answer describes the security property that allows a receiver to detect whether protected data was altered in transit.

Incorrect Answers

Answer A is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer B is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

Answer D is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

 

Question 8

What is the process by which VPN endpoints verify the identity of the device or user at the other end?

1. Peer authentication
2. Tunnel mode
3. Integrity
4. IKE

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes the process by which VPN endpoints verify the identity of the device or user at the other end.

Incorrect Answers

Answer B is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer C is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer D is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

 

Question 9

Which IPsec mode protects the entire original IP packet by encapsulating it inside a new IP packet?

1. Site-to-site VPN
2. Tunnel mode
3. ESP
4. AH

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Incorrect Answers

Answer A is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Answer C is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer D is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

 

Question 10

Which IPsec mode protects the IP payload while leaving the original outer IP header in place?

1. Transport mode
2. Remote-access VPN
3. Site-to-site VPN
4. ESP

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Incorrect Answers

Answer B is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer C is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Answer D is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

 

Question 11

For Site-to-site VPN, which statement is accurate?

1. A VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.
2. An IPsec mode that protects the IP payload while leaving the original outer IP header in place.
3. A VPN that securely connects an individual user or endpoint to a private network over an untrusted network.
4. An IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Incorrect Answers

Answer B is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer C is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer D is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

 

Question 12

For Remote-access VPN, which statement is accurate?

1. A VPN that securely connects an individual user or endpoint to a private network over an untrusted network.
2. The security property that allows a receiver to detect whether protected data was altered in transit.
3. An IPsec mode that protects the IP payload while leaving the original outer IP header in place.
4. A VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Correct Answer: A

 

Correct Answer

Answer A is correct because the selected answer describes a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Incorrect Answers

Answer B is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer C is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer D is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

 

Question 13

For IKE, which statement is accurate?

1. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.
2. An IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.
3. The protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.
4. The security property that allows a receiver to detect whether protected data was altered in transit.

Correct Answer: C

 

Correct Answer

Answer C is correct because it accurately defines IKE. The matching definition is: The protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Incorrect Answers

Answer A is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer B is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer D is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

 

Question 14

For ESP, which statement is accurate?

1. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.
2. The transformation that protects VPN data confidentiality from unauthorized readers.
3. The security property that allows a receiver to detect whether protected data was altered in transit.
4. An IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Correct Answer: A

 

Correct Answer

Answer A is correct because the choice accurately describes ESP: The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Incorrect Answers

Answer B is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer C is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer D is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

 

Question 15

For AH, which statement is accurate?

1. The process by which VPN endpoints verify the identity of the device or user at the other end.
2. An IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.
3. An IPsec mode that protects the IP payload while leaving the original outer IP header in place.
4. The transformation that protects VPN data confidentiality from unauthorized readers.

Correct Answer: B

 

Correct Answer

Answer B is correct because the selected answer describes an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Incorrect Answers

Answer A is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

Answer C is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer D is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

 

Question 16

An observer can capture VPN packets but must not be able to read their protected payload. Which statement describes the function of encryption in meeting this requirement?

1. The security property that allows a receiver to detect whether protected data was altered in transit.
2. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.
3. The process by which VPN endpoints verify the identity of the device or user at the other end.
4. The transformation that protects VPN data confidentiality from unauthorized readers.

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes the transformation that protects VPN data confidentiality from unauthorized readers.

Incorrect Answers

Answer A is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer B is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer C is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

 

Question 17

For Integrity, which statement is accurate?

1. The security property that allows a receiver to detect whether protected data was altered in transit.
2. The protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.
3. An IPsec mode that protects the IP payload while leaving the original outer IP header in place.
4. A VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Correct Answer: A

 

Correct Answer

Answer A is correct because it accurately defines Integrity. The matching definition is: The security property that allows a receiver to detect whether protected data was altered in transit.

Incorrect Answers

Answer B is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Answer C is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer D is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

 

Question 18

For Peer authentication, which statement is accurate?

1. The security property that allows a receiver to detect whether protected data was altered in transit.
2. A VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.
3. The process by which VPN endpoints verify the identity of the device or user at the other end.
4. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Correct Answer: C

 

Correct Answer

Answer C is correct because the choice accurately describes Peer authentication: The process by which VPN endpoints verify the identity of the device or user at the other end.

Incorrect Answers

Answer A is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer B is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Answer D is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

 

Question 19

For Tunnel mode, which statement is accurate?

1. The transformation that protects VPN data confidentiality from unauthorized readers.
2. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.
3. A VPN that securely connects an individual user or endpoint to a private network over an untrusted network.
4. An IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Incorrect Answers

Answer A is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer B is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer C is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

 

Question 20

For Transport mode, which statement is accurate?

1. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.
2. A VPN that securely connects an individual user or endpoint to a private network over an untrusted network.
3. An IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.
4. An IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Correct Answer: D

 

Correct Answer

Answer D is correct because the selected answer describes an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Incorrect Answers

Answer A is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer B is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer C is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

 

Question 21

Two office gateways maintain a protected connection between their LANs without each employee starting a personal tunnel. Which VPN arrangement fits this requirement?

1. Tunnel mode
2. ESP
3. Site-to-site VPN
4. Remote-access VPN

Correct Answer: C

 

Correct Answer

Answer C is correct because Site-to-site VPN directly provides the function required by the scenario. A VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Incorrect Answers

Answer A is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer B is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer D is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

 

Question 22

While working on an access-control investigation, an administrator encounters this requirement: A VPN that securely connects an individual user or endpoint to a private network over an untrusted network. Which answer is the most precise match?

1. Encryption
2. Remote-access VPN
3. Site-to-site VPN
4. Tunnel mode

Correct Answer: B

 

Correct Answer

Answer B is correct because the operational requirement in the stem maps to Remote-access VPN: A VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Incorrect Answers

Answer A is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer C is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Answer D is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

 

Question 23

In a campus security deployment, the team must identify the technology that provides the following function: The protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys. Which option should be selected?

1. IKE
2. Integrity
3. ESP
4. Peer authentication

Correct Answer: A

 

Correct Answer

Answer A is correct because IKE is the most precise fit for the stated requirement. The protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Incorrect Answers

Answer B is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer C is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Answer D is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

 

Question 24

An IPsec design needs a protocol that can encrypt protected traffic as well as supply integrity and anti-replay protection. Which protocol should be selected?

1. Tunnel mode
2. ESP
3. Encryption
4. IKE

Correct Answer: B

 

Correct Answer

Answer B is correct because the scenario is describing the role of ESP. The IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

Incorrect Answers

Answer A is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Answer C is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer D is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

 

Question 25

During a defensive configuration review, the design calls for the following capability: An IPsec protocol that provides integrity and authentication but does not encrypt the protected payload. Which option names that capability most accurately?

1. Peer authentication
2. AH
3. Encryption
4. ESP

Correct Answer: B

 

Correct Answer

Answer B is correct because AH directly provides the function required by the scenario. An IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Incorrect Answers

Answer A is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

Answer C is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer D is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

 

Question 26

A VPN must make intercepted payload bytes unreadable to an unauthorized observer. Which cryptographic operation provides this confidentiality?

1. Transport mode
2. Integrity
3. Peer authentication
4. Encryption

Correct Answer: D

 

Correct Answer

Answer D is correct because the operational requirement in the stem maps to Encryption: The transformation that protects VPN data confidentiality from unauthorized readers.

Incorrect Answers

Answer A is incorrect because the “Transport mode” option describes a different concept: an IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Answer B is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

Answer C is incorrect because the “Peer authentication” option describes a different concept: the process by which VPN endpoints verify the identity of the device or user at the other end.

 

Question 27

While working on an access-control investigation, an administrator encounters this requirement: The security property that allows a receiver to detect whether protected data was altered in transit. Which answer is the most precise match?

1. IKE
2. Encryption
3. ESP
4. Integrity

Correct Answer: D

 

Correct Answer

Answer D is correct because Integrity is the most precise fit for the stated requirement. The security property that allows a receiver to detect whether protected data was altered in transit.

Incorrect Answers

Answer A is incorrect because the “IKE” option describes a different concept: the protocol family used by IPsec to negotiate security associations and establish cryptographic parameters and keys.

Answer B is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer C is incorrect because the “ESP” option describes a different concept: the IPsec protocol that can provide confidentiality, integrity, authentication, and anti-replay protection for protected traffic.

 

Question 28

In a campus security deployment, the team must identify the technology that provides the following function: The process by which VPN endpoints verify the identity of the device or user at the other end. Which option should be selected?

1. Remote-access VPN
2. AH
3. Peer authentication
4. Encryption

Correct Answer: C

 

Correct Answer

Answer C is correct because the scenario is describing the role of Peer authentication. The process by which VPN endpoints verify the identity of the device or user at the other end.

Incorrect Answers

Answer A is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer B is incorrect because the “AH” option describes a different concept: an IPsec protocol that provides integrity and authentication but does not encrypt the protected payload.

Answer D is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

 

Question 29

An IPsec gateway places an entire original IP packet inside a new IP packet before sending it across the untrusted network. Which IPsec mode is being used?

1. Remote-access VPN
2. Encryption
3. Tunnel mode
4. Integrity

Correct Answer: C

 

Correct Answer

Answer C is correct because Tunnel mode directly provides the function required by the scenario. An IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.

Incorrect Answers

Answer A is incorrect because the “Remote-access VPN” option describes a different concept: a VPN that securely connects an individual user or endpoint to a private network over an untrusted network.

Answer B is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer D is incorrect because the “Integrity” option describes a different concept: the security property that allows a receiver to detect whether protected data was altered in transit.

 

Question 30

During a defensive configuration review, the design calls for the following capability: An IPsec mode that protects the IP payload while leaving the original outer IP header in place. Which option names that capability most accurately?

1. Site-to-site VPN
2. Transport mode
3. Encryption
4. Tunnel mode

Correct Answer: B

 

Correct Answer

Answer B is correct because the operational requirement in the stem maps to Transport mode: An IPsec mode that protects the IP payload while leaving the original outer IP header in place.

Incorrect Answers

Answer A is incorrect because the “Site-to-site VPN” option describes a different concept: a VPN that securely connects two networks through gateways, typically without individual users starting the tunnel manually.

Answer C is incorrect because the “Encryption” option describes a different concept: the transformation that protects VPN data confidentiality from unauthorized readers.

Answer D is incorrect because the “Tunnel mode” option describes a different concept: an IPsec mode that protects the entire original IP packet by encapsulating it inside a new IP packet.