CAS-004 Security Engineering Practice Question
A company is designing a secure communication channel between two branch offices over the internet using IPsec. Which TWO statements are true regarding IPsec modes and protocols? (Select TWO.)
⚠ Common exam trap
Option A may appear correct because IKEv2 is indeed used to negotiate IPsec security associations, but the question specifically asks about IPsec modes (tunnel/transport) and protocols (AH/ESP), not key exchange. Candidates often confuse the phases of IPsec with the actual encapsulation modes and protocols.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Tunnel mode encrypts the entire original IP packet
IKEv2 is a key exchange protocol used to establish IPsec security associations, but it is not a mode or protocol for encapsulating data packets; the question asks about IPsec modes and protocols (tunnel/transport, AH/ESP). Thus, A does not qualify as a true statement about IPsec modes and protocols. Option B is correct: Tunnel mode encapsulates and encrypts the entire original IP packet, adding a new IP header for routing. Option C is false: AH (Authentication Header) provides integrity and authentication but not confidentiality (no encryption). Option D is false: Transport mode encrypts only the payload of the IP packet, not the entire packet (the original IP header remains unencrypted). Option E is correct: ESP (Encapsulating Security Payload) provides confidentiality via encryption and optionally provides authentication and integrity.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IKEv2 is used to negotiate IPsec security associations
Why it's wrong here
IKEv2 is the key exchange protocol used to establish IPsec SAs, but it is not an IPsec mode or protocol for encapsulating data. The question asks about modes (tunnel/transport) and protocols (AH/ESP), not key exchange. Therefore, this statement, while true in another context, does not answer the question as asked.
- ✓
Tunnel mode encrypts the entire original IP packet
Why this is correct
Tunnel mode encapsulates and encrypts the entire original IP packet, adding a new IP header. This is a correct statement about an IPsec mode.
- ✗
AH provides confidentiality for the packet
Why it's wrong here
AH (Authentication Header) provides integrity and authentication but does not encrypt the payload, so it does not offer confidentiality. This statement is false.
- ✗
Transport mode encrypts the entire IP packet including the header
Why it's wrong here
Transport mode encrypts only the payload of the IP packet, not the entire packet. The original IP header remains unencrypted. This statement is false.
- ✓
ESP provides confidentiality and optional authentication
Why this is correct
ESP (Encapsulating Security Payload) provides confidentiality through encryption and optionally offers authentication and integrity. This is a correct statement about an IPsec protocol.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.