Certified Information Systems Security Professional CISSP · Free Practice Question Medium
Question 115
Victoria is the IT security manager at a large corporation that has recently implemented IPSec to secure its network communications. She has been asked to review the security practices of the company and make recommendations for any necessary changes. She noticed that the Authentication Header (AH) feature of IPSec is not being utilized. Which of the following is the main benefit of using the Authentication Header (AH) in IPSec?
- A It allows for the use of non-repudiation techniques
- B It provides data confidentiality
- C It authenticates the sender and verifies the integrity of the data
- D It allows for the creation of secure tunnels between devices
Reveal correct answer
Correct answer: C
Explanation
The correct answer: It authenticates the sender and verifies the integrity of the data. The Authentication Header (AH) protocol is a part of the Internet Protocol Security (IPsec) suite that provides connectionless integrity and data origin authentication for IP datagrams. It also provides optional protection against replay attacks. Its main function is to authenticate the sender (guarantee that the data indeed comes from the claimed sender) and verify the integrity of the transmitted data (ensure that the data has not been tampered with in transit). Its primary benefit is that it adds a layer of trust and validation to network communications. The incorrect answers: It provides data confidentiality: AH does not provide data confidentiality, which means it does not encrypt the data to prevent unauthorized access to information. This feature is provided by another IPsec protocol, the Encapsulating Security Payload (ESP), which does both encryption (provides confidentiality) and authentication. It allows for the creation of secure tunnels between devices: While IPsec can indeed be used to create Virtual Private Networks (VPNs) and establish secure tunnels between devices, this is not a feature specifically of AH, but rather of the overall IPsec suite that includes AH and ESP. It allows for the use of non-repudiation techniques: Non-repudiation is a security service that provides proof of the integrity and origin of data. While AH does provide data origin authentication and integrity, it does not offer non-repudiation because it doesn't provide a way to verify a message was sent (a digital signature), in a manner that can't be refuted later. Non-repudiation generally requires digital signatures and asymmetric cryptography, which is not a feature of AH.Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
You must be logged in to post a comment.
