Which of the following statements about Encapsulating Security Payload (ESP) is true?

ESP does not require AH; it can be deployed independently and provides its own integrity and optional authentication services.

ESP (Encapsulating Security Payload) is defined in RFC 4303 and can provide payload encryption for confidentiality as well as integrity checking and optional authentication, making it a versatile IPsec protocol. ESP can be used alone without AH because it includes its own integrity verification mechanism via an ICV (Integrity Check Value) field. In many deployments ESP alone is sufficient, as using both ESP and AH together is redundant and adds unnecessary overhead.

While ESP and AH are not required together, they can be combined in specific transport or tunnel mode configurations, so the claim that ESP is never used with AH is false.

ESP is not limited to integrity verification - one of its primary features is payload encryption for confidentiality, which AH cannot provide.