1. Home
2. All questions
3. Question 35

CISSP study material · question 35 of 500

A procurement team is comparing two IPsec gateways for a site-to-site deployment. One vendor implements Encapsulating Security Payload (ESP) only and calls that sufficient for a conforming implementation, while a reviewer insists Authentication Header (AH) is required so integrity-only protection remains available. Which position is correct?

• Network security
• Security engineering

1. The vendor: AH was removed from the architecture, so integrity-only protection is no longer offered by either protocol.
2. The vendor: ESP is mandatory and AH optional, because ESP can run with integrity enabled and encryption disabled.
3. The reviewer: both AH and ESP are mandatory, because each of them protects a different portion of the packet.
4. The reviewer: AH is mandatory and ESP optional, because AH is the only way to obtain integrity without confidentiality.

Challenge yourself on this topic → Study as cards