Study. uk . com
  1. Home
  2. All questions
  3. Question 37

CISSP study material · question 37 of 500

A firewall team operates an IPsec security gateway that terminates site-to-site tunnels and also receives Simple Network Management Protocol (SNMP) polling addressed to the gateway itself. An auditor asserts that every association on the box must use tunnel mode because a security gateway is an endpoint. Which case still permits transport mode?

  1. Traffic that leaves the gateway toward a remote host, since the far end terminates the association as a host.
  2. Traffic that terminates on the gateway itself, since the box is acting as a host rather than as a security gateway.
  3. Traffic that transits the gateway between two protected subnets, since the gateway only rewrites the outer header.
  4. Traffic that enters the gateway from the protected subnet, since the inner network is already a trusted segment.
Show the answer

Answer: B. Traffic that terminates on the gateway itself, since the box is acting as a host rather than as a security gateway.

Tunnel mode is compulsory once an endpoint is a security gateway; the exception is traffic terminating on the gateway itself, where it acts as a host, unlike transiting traffic.

Source: RFC 4301 (IETF) — RFC 4301 > 4.1 Definition and Scope

Challenge yourself on this topic → Study as cards