Quick Answer

The correct match is ESP in transport mode with NAT-T paired with UDP encapsulation of the ESP packet, because when Network Address Translation (NAT) is present, the standard ESP protocol cannot traverse NAT devices since it lacks port numbers, so UDP encapsulation wraps the entire ESP packet in a UDP header to preserve port information. In tunnel mode, a new IP header is added and the original IP header is encrypted, while transport mode encrypts only the payload, leaving the original IP header intact. On the ENCOR 350-401 exam, this drag-and-drop task tests your ability to distinguish between AH and ESP in both transport and tunnel modes, and a common trap is confusing AH transport mode—which authenticates the payload and original header—with ESP transport mode, which encrypts only the payload. Remember the key distinction: tunnel mode hides the original source and destination, transport mode does not. A helpful memory tip is “Tunnel hides the whole car, transport only locks the trunk.”