156-215.77 · Question #407
If you need strong protection for the encryption of user data, what option would be the BEST choice?
The correct answer is C. Use certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol. See the full explanation below for the reasoning.
Question
If you need strong protection for the encryption of user data, what option would be the BEST choice?
Options
- AWhen you need strong encryption, IPsec is not the best choice. SSL VPNs are a better choice.
- BDisable Diffie Hellman by using stronger certificate based key-derivation. Use AES-256 bit on all
- CUse certificates for Phase 1, SHA for all hashes, AES for all encryption and PFS, and use ESP protocol.
- DUse Diffie Hellman for key construction and pre-shared keys for Quick Mode. Choose SHA in Quick
How the community answered
(28 responses)- A4% (1)
- B11% (3)
- C82% (23)
- D4% (1)
Community Discussion
6
Luis F.Jun 3, 2026C is the right answer here. Using certificates for Phase 1 authentication, SHA for integrity hashing, AES for encryption, Perfect Forward Secrecy (PFS), and ESP gives you the full package of strong, standards-based protection, and PFS is key because it makes sure that even if one session key gets compromised, your other sessions stay safe.
Mei-Ling H.Jun 23, 2026Option C is the right call here because it stacks multiple layers correctly: certificates for Phase 1 authentication (stronger than pre-shared keys), AES for encryption, SHA for integrity, PFS to protect past sessions if a key is ever compromised, and ESP to actually encrypt the payload, not just authenticate it. The question says "BEST choice for strong protection," so every component has to pull its weight, and C is the only option where none of them are weak links. One thing I am still clarifying for myself: when the question specifies "user data," does that change anything about whether we should prefer ESP over AH, or is ESP always the answer when confidentiality is the goal, regardless of what kind of data is involved?
Lena V.Jun 19, 2026C is right, though "SHA" without specifying SHA-256 or higher is sloppy wording - avoid SHA-1.
Eitan E.Jun 12, 2026C is correct, and the key detail that separates it from a merely decent answer is the inclusion of PFS, because Perfect Forward Secrecy ensures that a compromised session key cannot be used to decrypt past or future sessions, which is exactly the layered assurance Check Point courseware ties to "strong protection of user data." ESP over AH is the right protocol choice here since ESP handles both encryption and integrity, while AH covers only authentication.
Lena V.Jun 13, 2026PFS is the right callout, but worth noting that on the cert you will also see questions where AH is the "correct" answer specifically because the scenario requires only authentication with no encryption overhead, so do not write it off entirely.
Anjali D.Jun 26, 2026Group agrees on C, ESP with PFS and AES covers both auth and encryption.