300-420 Question 197
Single answerA large enterprise is designing its network to support secure communication between its branch offices and the headquarters over the internet. The design requires confidentiality, data integrity, and authentication for all traffic. Which feature of IPsec should the design team prioritize to meet these requirements?
- A
Encapsulating Security Payload (ESP)
- B
Authentication Header (AH)
- C
Transport Mode
- D
Tunnel Mode
Show answer and explanation
Correct answer: A
Explanation
To meet the requirements for confidentiality, integrity, and authentication in a site-to-site VPN scenario, Encapsulating Security Payload (ESP) is the most appropriate feature of IPsec. ESP provides encryption for confidentiality, integrity checks, and authentication, ensuring secure communication between branch offices and the headquarters.
- A. Correct.
Encapsulating Security Payload (ESP) provides confidentiality through encryption, ensures data integrity, and offers authentication, making it suitable for securing communication between branch offices and headquarters.
- B. Incorrect.
Authentication Header (AH) only provides authentication and data integrity but does not offer encryption, hence it does not meet the confidentiality requirement of the scenario.
- C. Incorrect.
Transport Mode is used for securing end-to-end communication between hosts, but it is not typically used in site-to-site VPNs as it does not provide the encapsulation needed for securing traffic between branch offices and headquarters.
- D. Incorrect.
Tunnel Mode is used for encapsulating packets for site-to-site VPNs, but on its own, it does not provide encryption, authentication, or data integrity. It is used in conjunction with ESP or AH.