SSCP Network and Communications Security Practice Question
A security engineer is reviewing a network architecture that uses IPsec in tunnel mode between two site gateways. The engineer must verify that the design provides confidentiality for the entire original IP packet. Which component of the IPsec architecture is responsible for encrypting the payload and providing confidentiality?
⚠ Common exam trap
The trap here is assuming that AH provides encryption because it is part of IPsec, but AH only offers integrity and authentication, not confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Encapsulating Security Payload (ESP)
In IPsec, ESP is the protocol that provides confidentiality by encrypting the payload. In tunnel mode, it encrypts the entire original IP packet, ensuring that the contents are protected. AH only provides integrity and authentication without encryption, while IKE and SAs are supporting components that establish and define security parameters but do not perform encryption.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Encapsulating Security Payload (ESP)
Why this is correct
ESP is the IPsec component that provides confidentiality by encrypting the payload. In tunnel mode, ESP encrypts the entire original IP packet and encapsulates it within a new IP packet. Thus, it meets the requirement to protect the original packet's contents from eavesdropping.
- ✗
Security Association (SA)
Why it's wrong here
An SA defines the parameters for secure communication, such as algorithms and keys, but it is not a mechanism that encrypts data. It is a logical connection that specifies how traffic is protected. The actual encryption is performed by ESP (or AH for integrity), not by the SA itself.
- ✗
Internet Key Exchange (IKE)
Why it's wrong here
IKE is used to negotiate and establish security associations (SAs) between peers, including key exchange and authentication. It does not directly encrypt data traffic. While essential for setting up IPsec, IKE itself does not provide confidentiality for the encapsulated payload.
- ✗
Authentication Header (AH)
Why it's wrong here
AH provides data integrity and authentication of the IP packet, including the outer IP header, but it does not encrypt the payload. Therefore, it cannot provide confidentiality for the original IP packet. In tunnel mode, AH still leaves the encapsulated packet readable. This option fails the requirement for encryption.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 971 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.