An administrator intends to configure an IPSec solution that provides ESP with integrity protection, but not confidentiality protection. Which of the following AES modes of operation would meet this…

HMAC (Hash-based Message Authentication Code) is a message integrity and authentication mechanism that produces a fixed-size digest to verify data has not been tampered with, but performs no encryption whatsoever. In IPSec ESP, using a null cipher alongside HMAC-SHA (e.g., HMAC-SHA-256) provides integrity and authentication without confidentiality, which is exactly the stated requirement.

PCBC (Propagating Cipher Block Chaining) is a block cipher mode of operation that encrypts data, providing confidentiality rather than integrity-only protection, and is not used in standard IPSec implementations.

CBC (Cipher Block Chaining) is an AES encryption mode that provides confidentiality by chaining cipher blocks, not integrity-only protection, and would violate the no-confidentiality requirement.

GCM (Galois/Counter Mode) is an authenticated encryption mode that provides both confidentiality AND integrity simultaneously, failing the requirement to exclude confidentiality protection.

CFB (Cipher Feedback) is an AES mode of operation that encrypts data to provide confidentiality, not integrity-only protection, making it unsuitable for this use case.