Study. uk . com
  1. Home
  2. All questions
  3. Question 283

CISSP study material · question 283 of 500

An IPsec deployment relies on anti-replay protection but the receiving implementation never inspects sequence numbers. What does RFC 4302 say about the result?

  1. The service still works, because the sender increments the number by default.
  2. The service is ineffective, because it works only if the receiver checks the sequence number.
  3. The service is invalid, because anti-replay is chosen by the sender.
  4. The service degrades to integrity only, which is still sufficient.
Show the answer

Answer: B. The service is ineffective, because it works only if the receiver checks the sequence number.

The sender increments the sequence number by default, but the service only bites when the receiver checks it, and the receiver selects it at setup.

Source: RFC 4302 (IETF) — RFC 4302 > 1. Introduction

Challenge yourself on this topic → Study as cards