CISSP Communication and Network Security Practice Question
Which IPsec protocol provides both authentication and encryption of the packet payload, but does not encrypt the IP header?
⚠ Common exam trap
Many exam-takers confuse 'encryption of the payload' with 'encryption of the entire packet,' leading them to choose ESP in tunnel mode, which encrypts the inner IP header, or AH, which provides no encryption at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
ESP in transport mode
ESP in transport mode encrypts the payload and provides authentication (via an optional ICV), but it does not encrypt the IP header. This matches the question's requirement of payload authentication and encryption without header encryption. In contrast, AH authenticates the entire packet (including the IP header) but provides no encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AH in transport mode
Why it's wrong here
Authentication Header (AH) in transport mode provides data integrity, data origin authentication, and anti-replay protection for the IP payload and outer header. However, it completely lacks confidentiality capabilities, meaning it does not perform any encryption on the transmitted data, making it unsuitable when confidentiality is required.
- ✓
ESP in transport mode
Why this is correct
Encapsulating Security Payload (ESP) in transport mode encrypts the IP payload to ensure confidentiality while also providing integrity and authentication for the payload and ESP headers. This mode is highly efficient for direct host-to-host communication because it secures the upper-layer data without the overhead of a new IP header.
- ✗
AH in tunnel mode
Why it's wrong here
In tunnel mode, the Authentication Header (AH) encapsulates the entire original IP packet and adds a new outer IP header to protect against tampering. Despite this extensive integrity coverage and origin authentication, AH still does not support encryption, leaving the payload fully visible in transit.
- ✗
ESP in tunnel mode
Why it's wrong here
While ESP in tunnel mode provides both encryption and authentication, it encapsulates the entire original IP packet inside a new IP header, which is typically reserved for gateway-to-gateway VPNs. For direct host-to-host communications where only the payload needs protection, transport mode is the standard implementation to avoid this encapsulation overhead.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Architecture and Models
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.