SAD (Security Association) is a parameter that must be negotiated when an IPsec tunnel is established, so which of the following parameters is used to uniquely identify SA? (Multiple choice)

Question

Options

• ASource MAC address
• BDestination IP address
• CSecurity Protocol Number
• DSource of the encrypted network layer header
• ESPI (Security Parameter Index)
• FSource IP address

• A
  100% (16)

Explanation

In standard IPsec (per RFC 4301), a Security Association is uniquely identified by a three-tuple: the SPI (E), the Destination IP Address (B), and the Security Protocol identifier (C - either AH=51 or ESP=50). These three values together allow a receiving device to look up the correct SA in its Security Association Database (SAD) and apply the right cryptographic parameters to incoming traffic.

Note on the stated answer key: Marking all six options (A–F) as correct conflicts with the RFC 4301 standard. Specifically:

• Source MAC address (A) is a Layer 2 identifier - IPsec operates at Layer 3 and MAC addresses are irrelevant to SA lookup.
• Source IP address (F) is stored in the SAD but is not part of the canonical identifying triple; the standard uses the destination IP.
• Option D ("Source of the encrypted network layer header") is ambiguous phrasing and not a recognized SA identifier field.

The reliable, exam-safe answer for "what uniquely identifies an SA" is B, C, and E - the standard triple.

Memory tip: Think "SPI-DIP-Proto" - Security Parameter Index + Destination IP + Protocol. The destination (not source) IP matters because the SA is selected from the receiver's perspective, and the SPI is embedded in the AH/ESP header to tell the receiver exactly which SA to use.

If your exam insists all six are correct, verify against your course material - this may reflect a non-RFC curriculum definition or a question error.

No community discussion yet for this question.