Study. uk . com
  1. Home
  2. All questions
  3. Question 275

CISSP study material · question 275 of 500

An architect asks why AH became optional when it uniquely provides integrity without encryption. What does RFC 4301 say?

  1. AH was found insecure and deprecated on cryptographic grounds.
  2. AH was folded into IKEv2 and is no longer a separate protocol.
  3. AH cannot traverse address translation, which made it unusable.
  4. ESP can be run for integrity alone without confidentiality, making it comparable to AH in most contexts.
Show the answer

Answer: D. ESP can be run for integrity alone without confidentiality, making it comparable to AH in most contexts.

Because ESP may be run for integrity alone, it covers what AH offered in nearly every context, which is why AH support fell to optional.

Source: RFC 4301 (IETF) — RFC 4301 > 3.2 How IPsec Works

Challenge yourself on this topic → Study as cards