CCNA Network Services and Security Practice Question
A network administrator is configuring a site-to-site IPsec VPN between two Cisco routers. The administrator wants to ensure that the VPN traffic is protected by both encryption and integrity checking. Which combination of IPsec protocols should be used?
⚠ Common exam trap
The trap here is assuming that AH provides encryption, when it only provides integrity and authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ESP for both encryption and integrity
ESP (Encapsulating Security Payload) is the IPsec protocol that can provide both encryption and integrity. It supports confidentiality through encryption algorithms and integrity through authentication algorithms. AH (Authentication Header) provides only integrity and authentication, not encryption. Therefore, to meet the requirement of both encryption and integrity, ESP alone is sufficient and is the standard choice for site-to-site VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ESP for encryption and AH for integrity
Why it's wrong here
While ESP can provide encryption and AH can provide integrity, this combination is not typical and may not be supported in all implementations. ESP can provide both encryption and integrity, so using both AH and ESP is redundant. In modern IPsec deployments, ESP is preferred because it can handle both functions. Using AH for integrity alone is unnecessary if ESP is already providing integrity.
- ✓
ESP for both encryption and integrity
Why this is correct
ESP (Encapsulating Security Payload) can provide confidentiality through encryption and integrity through authentication. It is the recommended protocol for IPsec VPNs because it supports both functions in a single protocol. In site-to-site VPNs, ESP is commonly used with encryption algorithms like AES and integrity algorithms like SHA. This meets the requirement without the need for AH.
- ✗
AH for both encryption and integrity
Why it's wrong here
AH (Authentication Header) provides integrity and authentication but does not provide encryption. Therefore, it cannot satisfy the requirement for encryption. AH is used when only integrity and authentication are needed, but it is not suitable for protecting confidentiality. The requirement explicitly includes encryption, so AH alone is insufficient.
- ✗
AH for encryption and ESP for integrity
Why it's wrong here
AH (Authentication Header) provides integrity and authentication but does not provide encryption. ESP (Encapsulating Security Payload) can provide both encryption and integrity. Using AH for encryption is incorrect because AH does not encrypt payload. The requirement is for both encryption and integrity, so ESP alone can provide both, or AH can be combined with ESP, but AH cannot provide encryption.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
802.1X Port Authentication
Key term
Integrity
Integrity is the assurance that data has not been altered or tampered with in an unauthorized way, preserving its accuracy and consistency from source to destination.
Key term
AH
AH (Authentication Header) is an IPsec protocol that provides connectionless integrity, data origin authentication, and anti-replay protection for IP packets.
About these practice questions
This 200-301 question is part of Courseiva's 1,450-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 200-301 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-301 exam.