350-401 Security Practice Question
A network administrator is configuring a site-to-site VPN between two Cisco routers using IPsec. The administrator wants to ensure that the data transmitted between the sites is encrypted and authenticated. Which IPsec protocol should be used to provide both confidentiality and integrity for the data payload?
⚠ Common exam trap
The trap here is selecting AH because it sounds like it provides authentication, but it lacks encryption; ESP is needed for confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encapsulating Security Payload (ESP)
ESP is the IPsec protocol that provides both confidentiality (encryption) and integrity/authentication for the data payload. AH only provides integrity and authentication, while IKE is for key exchange and GRE is a tunneling protocol without built-in security. Therefore, ESP is the correct choice for encrypting and authenticating VPN traffic.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generic Routing Encapsulation (GRE)
Why it's wrong here
GRE is a tunneling protocol that can encapsulate various protocols, but it does not provide encryption or authentication by itself. It is often used with IPsec to add encryption. Without IPsec, GRE tunnels are not secure. The requirement for encryption and authentication means GRE alone is insufficient; it must be combined with IPsec, but the question asks for the IPsec protocol that provides these services.
- ✗
Internet Key Exchange (IKE)
Why it's wrong here
IKE is used to negotiate and establish security associations (SAs) between peers. It handles key exchange and authentication of the peers, but it does not encrypt data traffic. IKE is a control protocol for IPsec, not a data encapsulation protocol. The question asks for the protocol that provides confidentiality and integrity for the data payload, which is not IKE's role.
- ✗
Authentication Header (AH)
Why it's wrong here
AH provides authentication and integrity but does not provide confidentiality (encryption). It is used when encryption is not required or is handled by another protocol. Since the requirement is to encrypt the data, AH alone is insufficient. AH is often used in conjunction with ESP, but ESP alone can provide both encryption and authentication.
- ✓
Encapsulating Security Payload (ESP)
Why this is correct
ESP provides confidentiality through encryption and can also provide authentication and integrity for the payload. It is the standard choice for VPNs requiring encryption. ESP can operate in transport or tunnel mode; in tunnel mode, it encrypts the entire original IP packet. This meets the requirement for both confidentiality and integrity of the data payload.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Wireless Deployment Models and Security
Key term
IPsec Tunnel
An IPsec tunnel is a secure, encrypted connection between two network devices that protects data as it travels across the internet or another untrusted network.
Key term
GRE
GRE (Generic Routing Encapsulation) is a tunneling protocol that encapsulates packets inside other packets to transport them across incompatible networks.
About these practice questions
One of 1,923 original 350-401 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.