Which of the following descriptions of the AH and ESP protocols is correct?

Question

Options

• AAll support data source verification
• BAll support encryption
• CAll support NAT traversal
• DVerify IP headers

• A
  72% (13)
• B
  6% (1)
• C
  17% (3)
• D
  6% (1)

Explanation

Both AH and ESP are IPsec protocols, and both provide data origin authentication - meaning they verify that packets genuinely came from the claimed source and haven't been tampered with. This is accomplished through cryptographic integrity checks (HMAC-based) that both protocols apply to payload data, making option A correct for both.

Why the distractors are wrong:

• B (encryption): Only ESP supports encryption/confidentiality. AH provides no encryption whatsoever - it authenticates but never hides data.
• C (NAT traversal): AH cannot survive NAT because it includes the outer IP header in its integrity check - when NAT rewrites that IP address, the check fails. ESP supports NAT-T (NAT Traversal via UDP encapsulation); AH does not.
• D (verify IP headers): AH does authenticate the IP header, but ESP does not protect the outer IP header - so this statement is false for ESP, making it incorrect for "all."

Memory tip: Use the mnemonic "Both Authenticate, ESP Encrypts" - AH and ESP share authentication (source verification) as their common ground, but only ESP adds the encryption layer, and only ESP survives NAT. If a question says "both/all," authentication is the only feature you can safely assign to both.

No community discussion yet for this question.