Study. uk . com
  1. Home
  2. All questions
  3. Question 280

CISSP study material · question 280 of 500

An engineer assumes the security parameters index alone is always enough to identify a security association. When does RFC 4301 say that is not so?

  1. For any association negotiated by IKEv2 rather than configured manually.
  2. For associations carrying AH, which are identified by sequence number instead.
  3. For tunnel mode associations, which require the outer addresses as well.
  4. For multicast, where a group association and a unicast one may share an index and the implementation must still demultiplex correctly.
Show the answer

Answer: D. For multicast, where a group association and a unicast one may share an index and the implementation must still demultiplex correctly.

For unicast the index alone suffices, but a multicast-capable implementation must handle index collisions, since a group association's index is assigned centrally without coordination.

Source: RFC 4301 (IETF) — RFC 4301 > 4.1 Definition and Scope

Challenge yourself on this topic → Study as cards