GSLC · Question #116
US Garments wants all encrypted data communication between corporate office and remote location. They want to achieve following results: - Authentication of users - Anti-replay - Anti-spoofing - IP…
The correct answer is B. Anti-spoofing C. Anti-replay. IPSec Authentication Header (AH) provides integrity, anti-replay, and anti-spoofing but does not encrypt the IP payload, so it satisfies anti-spoofing and anti-replay requirements but not user authentication or packet encryption.
Question
US Garments wants all encrypted data communication between corporate office and remote location. They want to achieve following results:
- Authentication of users
- Anti-replay
- Anti-spoofing
- IP packet encryption
They implemented IPSec using Authentication Headers (AHs). Which results does this solution provide? (Click the Exhibit button on the toolbar to see the case study.) Each correct answer represents a complete solution. Choose all that apply.
Options
- AAuthentication of users
- BAnti-spoofing
- CAnti-replay
- DIP packet encryption
How the community answered
(29 responses)- A14% (4)
- B76% (22)
- D10% (3)
Why each option
IPSec Authentication Header (AH) provides integrity, anti-replay, and anti-spoofing but does not encrypt the IP payload, so it satisfies anti-spoofing and anti-replay requirements but not user authentication or packet encryption.
AH provides data-origin authentication at the IP packet level by verifying the source IP address, but it does not perform user-level authentication such as username/password or certificate-based identity verification for individual users.
AH authenticates the source IP address by computing a cryptographic HMAC over the packet headers, which prevents an attacker from forging the source address and therefore provides anti-spoofing protection.
AH includes a sequence number field that IPSec peers use to detect and discard duplicate or out-of-order packets, directly providing anti-replay protection against attackers who capture and retransmit packets.
AH does not encrypt the IP payload - it only provides integrity and authentication via HMAC; encryption of IP packet contents requires IPSec ESP (Encapsulating Security Payload), not AH.
Concept tested: IPSec Authentication Header capabilities and limitations vs ESP
Source: https://datatracker.ietf.org/doc/html/rfc4302
Topics
Community Discussion
No community discussion yet for this question.