CCNP Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Generic Routing Encapsulation (GRE)

  Why it's wrong here

  GRE is a tunneling protocol that can encapsulate various protocols, but it does not provide encryption or authentication by itself. It is often used with IPsec to add encryption. Without IPsec, GRE tunnels are not secure. The requirement for encryption and authentication means GRE alone is insufficient; it must be combined with IPsec, but the question asks for the IPsec protocol that provides these services.

• ✗

  Internet Key Exchange (IKE)

  Why it's wrong here

  IKE is used to negotiate and establish security associations (SAs) between peers. It handles key exchange and authentication of the peers, but it does not encrypt data traffic. IKE is a control protocol for IPsec, not a data encapsulation protocol. The question asks for the protocol that provides confidentiality and integrity for the data payload, which is not IKE's role.

• ✗

  Authentication Header (AH)

  Why it's wrong here

  AH provides authentication and integrity but does not provide confidentiality (encryption). It is used when encryption is not required or is handled by another protocol. Since the requirement is to encrypt the data, AH alone is insufficient. AH is often used in conjunction with ESP, but ESP alone can provide both encryption and authentication.

• ✓

  Encapsulating Security Payload (ESP)

  Why this is correct

  ESP provides confidentiality through encryption and can also provide authentication and integrity for the payload. It is the standard choice for VPNs requiring encryption. ESP can operate in transport or tunnel mode; in tunnel mode, it encrypts the entire original IP packet. This meets the requirement for both confidentiality and integrity of the data payload.