CAS-004 Security Engineering Practice Question
An organization is implementing IPsec VPNs between sites. The security team wants to ensure data integrity and authentication but is less concerned about confidentiality for this particular link. Which IPsec protocol and mode should they use?
⚠ Common exam trap
CAS-005 often tests the difference between AH and ESP; candidates may choose ESP for integrity, but ESP without encryption is not standard, and AH is specifically for integrity without confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AH in tunnel mode
IPsec AH (Authentication Header) provides data integrity and authentication but not confidentiality (no encryption). Tunnel mode encapsulates the entire IP packet, which is suitable for site-to-site VPNs. Since confidentiality is not a concern, AH in tunnel mode is the correct choice. ESP would provide confidentiality, which is unnecessary here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
ESP in tunnel mode
Why it's wrong here
ESP encrypts the payload, so it provides confidentiality the scenario explicitly does not require; AH supplies integrity and authentication without encryption. ESP in tunnel mode is the right pick when confidentiality across an untrusted network is needed, such as site-to-site traffic over the public internet.
- ✓
AH in tunnel mode
Why this is correct
AH provides data integrity and origin authentication through its ICV, but performs no encryption, matching the stated indifference to confidentiality. Tunnel mode encapsulates the entire original IP packet, protecting traffic between the two site gateways rather than just host-to-host flows.
- ✗
AH in transport mode
Why it's wrong here
Transport mode leaves the original IP header unprotected, so it does not authenticate the tunnel endpoints themselves; site-to-site gateways require tunnel mode to encapsulate and authenticate whole packets. It is tempting because AH does supply integrity and authentication, and transport mode would be correct for host-to-host traffic between two endpoints.
- ✗
ESP in transport mode
Why it's wrong here
ESP encrypts the payload, so it provides confidentiality the team explicitly does not require, and transport mode protects only the packet payload rather than the full tunnel between gateways. It is tempting because ESP is the common choice, and it would be correct when payload encryption across a site-to-site tunnel is needed.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.