CAS-004 Security Engineering Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Transport mode with AH

  Why it's wrong here

  AH provides integrity and authentication but no encryption, so the packet payload is never encrypted, and transport mode leaves the original IP header intact and unencrypted. AH is tempting where only integrity and anti-replay are required, such as authenticating routing updates between trusted peers.

• ✗

  Tunnel mode with AH

  Why it's wrong here

  Tunnel mode encapsulates the entire original packet, but AH still performs no encryption, so the requirement to encrypt the packet is unmet. AH is tempting for integrity-only protection, such as authenticating traffic between gateways where confidentiality is not required.

• ✗

  Transport mode with ESP

  Why it's wrong here

  ESP encrypts only the payload; transport mode leaves the original IP header unencrypted and unencapsulated, so the whole-packet requirement fails. Transport mode with ESP is tempting for host-to-host encryption between two endpoints, where the original header need not be hidden.

• ✓

  Tunnel mode with ESP

  Why this is correct

  Tunnel mode encapsulates the entire original IP packet, including its header, inside a new IP packet, whereas transport mode protects only the payload. ESP supplies the encryption, so tunnel mode with ESP encrypts the whole packet as the stem requires.