CISSP Communication and Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  It provides better performance than transport mode

  Why it's wrong here

  IPSec tunnel mode introduces significant overhead because it encapsulates the entire original IP packet, including its header and payload, within a completely new IP packet. This process involves adding a new outer IP header and performing cryptographic operations (encryption and authentication) on a larger data unit. Consequently, the increased packet size and the additional processing required for encapsulation and de-encapsulation typically result in lower throughput and higher latency compared to transport mode, which processes only the original packet's payload.

• ✓

  A new IP header is added to the packet

  Why this is correct

  In IPSec tunnel mode, the fundamental mechanism involves taking the complete original IP packet, which includes both its header and its payload, and encapsulating it. A distinct and entirely new outer IP header is then prepended to this encapsulated data. This new header contains the IP addresses of the IPSec endpoints (e.g., security gateways), allowing the packet to be routed across intermediate networks while the original packet's addressing information remains hidden and protected within the tunnel.

• ✓

  The entire original IP packet is encapsulated and encrypted

  Why this is correct

  IPSec tunnel mode is designed to provide comprehensive security by treating the entire original IP packet as the data to be protected. This means that both the original IP header, which contains source and destination addresses, and the original payload are fully encapsulated within a new IP packet. When encryption is applied, the entirety of this encapsulated original packet is encrypted, ensuring that all original packet information, including sensitive routing details and application data, remains confidential and integrity-protected.

• ✗

  It is used for end-to-end communication between hosts

  Why it's wrong here

  IPSec tunnel mode is primarily engineered for securing communications between network devices, such as security gateways (e.g., routers or firewalls) that act on behalf of entire networks or subnets. It establishes a secure 'tunnel' through which traffic from multiple hosts can pass securely between two networks. While a single host can technically implement tunnel mode, its most common and efficient application is for site-to-site VPNs or remote access VPNs, rather than direct, end-to-end host-to-host communication, which is typically handled by transport mode.

• ✗

  Only the payload of the packet is encrypted

  Why it's wrong here

  This statement accurately describes the behavior of IPSec transport mode when using Encapsulating Security Payload (ESP), where only the data portion (payload) of the original IP packet is encrypted, leaving the original IP header exposed for routing. In stark contrast, IPSec tunnel mode encrypts the *entire* original IP packet, encompassing both its header and its payload. This fully encrypted original packet is then encapsulated within a new, outer IP packet, providing a much higher degree of confidentiality for all original packet information.

Go deeper

Related to this question