CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AH in transport mode

  Why it's wrong here

  AH provides data origin authentication and integrity only; it does not encrypt the payload, so it cannot satisfy the confidentiality requirement in transport mode. It is tempting because AH genuinely authenticates packets, and would be correct where integrity protection without encryption is acceptable, such as certain internal routing scenarios.

• ✗

  IKEv2

  Why it's wrong here

  IKEv2 negotiates and manages Security Associations for IPsec; it does not itself authenticate or encrypt the tunnel's data traffic, which ESP performs. It is tempting because IKEv2 is the modern choice for establishing IPsec VPNs, and it would be correct when the requirement is robust, resilient key exchange and reconnection.

• ✓

  ESP in tunnel mode

  Why this is correct

  ESP encrypts the payload and authenticates its origin and integrity, delivering confidentiality plus authentication in one protocol. Tunnel mode encapsulates the entire original packet, so the site-to-site VPN's demand for both services is met without adding AH alongside.

• ✗

  AH in tunnel mode

  Why it's wrong here

  Tunnel mode changes which addresses AH protects, but AH still performs no encryption, so confidentiality remains unmet. It is tempting because tunnel mode is the usual VPN encapsulation, and would be correct when AH's integrity-only protection is needed across gateways, such as authenticating traffic between trusted sites.