Study. uk . com
  1. Home
  2. All questions
  3. Question 272

CISSP study material · question 272 of 500

A procurement specification demands that an IPsec implementation support both AH and ESP as mandatory. What does RFC 4301 actually require, and why?

  1. Both must be supported, since neither provides all services alone.
  2. AH must be supported and ESP may be, since integrity is the base service.
  3. ESP must be supported and AH may be; experience showed few contexts where ESP could not provide the services needed.
  4. Neither is mandatory; the choice rests entirely with the deployment.
Show the answer

Answer: C. ESP must be supported and AH may be; experience showed few contexts where ESP could not provide the services needed.

RFC 4301 requires implementations to support ESP and only permits AH, noting AH support was downgraded because ESP can cover nearly every case, including integrity without confidentiality.

Source: RFC 4301 (IETF) — RFC 4301 > 3.2 How IPsec Works

Challenge yourself on this topic → Study as cards