After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, statefull firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measu

The correct answer is C. NAT does not work with IPSEC. NAT modifies IP headers by rewriting source/destination addresses (and sometimes ports), which fundamentally conflicts with IPSec. IPSec's Authentication Header (AH) mode creates a cryptographic hash that covers the entire IP packet including headers; any NAT modification invalid

Submitted by dimitri_ru· Apr 18, 2026Network Forensics

Question

After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, statefull firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

Options

AIPSEC does not work with packet filtering firewalls
BStatefull firewalls do not work with packet filtering firewalls
CNAT does not work with IPSEC
DNAT does not work with statefull firewalls

How the community answered

(30 responses)

A
17% (5)
B
7% (2)
C
73% (22)
D
3% (1)

Explanation

NAT modifies IP headers by rewriting source/destination addresses (and sometimes ports), which fundamentally conflicts with IPSec. IPSec's Authentication Header (AH) mode creates a cryptographic hash that covers the entire IP packet including headers; any NAT modification invalidates that hash and causes the packet to be rejected. Even ESP mode is problematic because TCP/UDP ports may be encrypted, preventing NAT from performing port address translation. The solution is NAT-T (NAT Traversal, RFC 3947), which encapsulates IPSec packets inside UDP port 4500 to allow them to traverse NAT devices.

Topics

#NAT#IPSEC#Network Security Protocols#Firewall Configuration

Community Discussion

No community discussion yet for this question.

Full 312-49 Practice