nerdexam
CompTIA

N10-009 · Question #276

Which of the following are the main differences between ESP and AH? (Choose two.)

The correct answer is C. ESP provides confidentiality through the use of encryption. D. AH provides authentication for IP headers and their payloads. ESP provides confidentiality through encryption and authenticates the payload, whereas AH ensures integrity and authentication for the entire IP packet, including its header, without encryption.

Submitted by lukas.cz· Mar 6, 2026Network Security

Question

Which of the following are the main differences between ESP and AH? (Choose two.)

Options

  • AAH provides confidentiality through the use of encryption.
  • BESP provides authentication for IP headers and their payloads.
  • CESP provides confidentiality through the use of encryption.
  • DAH provides authentication for IP headers and their payloads.
  • EAH provides data origin authorization over shared secret.
  • FESP provides data origin authorization over shared secret.

How the community answered

(32 responses)
  • A
    3% (1)
  • B
    6% (2)
  • C
    72% (23)
  • E
    3% (1)
  • F
    16% (5)

Why each option

ESP provides confidentiality through encryption and authenticates the payload, whereas AH ensures integrity and authentication for the entire IP packet, including its header, without encryption.

AAH provides confidentiality through the use of encryption.

AH provides integrity and authentication but does not offer confidentiality through encryption.

BESP provides authentication for IP headers and their payloads.

ESP provides authentication for its own header and the data payload, but typically not the entire original IP header in the same comprehensive manner as AH.

CESP provides confidentiality through the use of encryption.Correct

Encapsulating Security Payload (ESP) provides confidentiality by encrypting the IP packet's data payload, ensuring that unauthorized parties cannot read the data.

DAH provides authentication for IP headers and their payloads.Correct

Authentication Header (AH) provides data origin authentication, data integrity, and anti-replay protection for the entire IP packet, including both the IP header and the payload.

EAH provides data origin authorization over shared secret.

While AH does provide data origin authentication, choice D is a more comprehensive description of its primary function compared to ESP.

FESP provides data origin authorization over shared secret.

While ESP can provide data origin authentication for its payload, choice C highlights its unique confidentiality feature, which is a key distinction from AH.

Concept tested: IPsec AH vs ESP differences

Source: https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-firewall/authenticating-ip-traffic-with-ipsec#authentication-header-ah-and-encapsulating-security-payload-esp

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full N10-009 Practice