Which of the following statements is NOT true of IPSec Transport mode?

This statement is NOT true. IPSec Transport mode encrypts and/or authenticates the IP payload directly between two end hosts, preserving the original IP header. Gateway-to-gateway or gateway-to-host scenarios for accessing internal networks typically use IPSec Tunnel mode, which encapsulates the entire original IP packet with a new IP header, providing protection for traffic passing through an intermediary gateway.

Transport mode is indeed set up when the communication terminates at the end-points (hosts), as it provides end-to-end security between them.

If Transport mode were used in a gateway-to-host communication, the gateway would essentially have to terminate the IPSec session as if it were the host itself, which is not its typical role for securing internal systems access (where Tunnel mode is preferred).

When ESP is used in Transport mode, it typically protects the transport layer segment (e.g., TCP/UDP header and data), and the hash (for integrity) is applied to this upper layer data, not the full original IP header, which remains exposed.