📝 IPSec network layer security (10 MCQs)

📖 From Data Communication and Networks • 32. Internet Security • 10 questions available

← Previous Topic📝 IPSec network layer securityIPSec transport and tunnel modes: Two Modes:Next Topic→

What is IPSec network layer security?

IPSec is a framework of open standards that operates at the network layer to provide secure communication over IP networks by authenticating and encrypting each IP packet in a data stream.

Easy

Medium

Hard

📝 All IPSec network layer security MCQs

Q1. If an IPsec tunnel is misconfigured such that the security association (SA) parameters do not match on both ends, which of the following is the most likely immediate effect?

A.The packets are silently discarded by the receiving router.

B.Communication fails with an authentication failure error. ✅

C.Traffic continues unencrypted, exposing data.

D.The tunnel automatically renegotiates its parameters.

💡 Difficulty: easy | ✅ Correct: B

📖 Explanation: When the SA parameters (such as encryption algorithm or keys) differ between the two endpoints, the receiving IPsec implementation cannot verify the packet’s integrity. It therefore generates an authentication failure and discards the packet, reporting the error to the upper layer. This prevents insecure communication, making option B the correct outcome.

Q2. A routing protocol that relies on UDP for message exchange is observed to be vulnerable to spoofed distance-vector updates. Which inference best explains why network-layer security mechanisms are essential for this protocol?

A.UDP provides built‑in encryption, making additional security unnecessary.

B.Routing updates are authenticated at the application layer, so network-layer security adds no value.

C.Spoofed updates cannot reach routers due to inherent IP checksum validation.

D.Because UDP is connectionless, unauthenticated updates can be injected, so network-layer security must provide authentication and integrity. ✅

💡 Difficulty: medium | ✅ Correct: D

📖 Explanation: UDP provides no built‑in mechanisms for authentication or integrity, so routing protocols that exchange messages over UDP are susceptible to forged updates. An attacker can inject malicious distance‑vector information, causing incorrect routing decisions. Therefore, network‑layer security must supply authentication and integrity protection, which is precisely the reasoning captured in option D.

Q3. An attacker modifies the TTL field of an IP packet to 1 before it reaches a router that performs IPsec ESP processing. What vulnerability does this exploit, and what is the likely outcome?

A.It exploits the TTL expiration to cause the packet to be dropped before ESP processing, preventing decryption and enabling a denial‑of‑service. ✅

B.Altering TTL bypasses ESP encryption, allowing the attacker to read the payload.

C.Changing TTL triggers a routing loop that reveals the ESP keys.

D.Modifying TTL forces the router to ignore the SA, resulting in plaintext forwarding.

💡 Difficulty: medium | ✅ Correct: A

📖 Explanation: The TTL (Time‑to‑Live) field determines how many hops a packet may traverse before being discarded. By setting TTL to 1, the packet expires at the next router, never reaching the ESP decryption stage. This creates a denial‑of‑service condition without exposing the payload, matching the description in option A.

Q4. Which statement correctly compares IPsec and TLS when used to protect network-layer traffic?

A.IPsec operates only at the application layer, while TLS works at the network layer.

B.TLS provides confidentiality, whereas IPsec provides only authentication.

C.IPsec secures each IP packet independently, protecting routing information, whereas TLS secures a stream after a TCP connection is established. ✅

D.Both IPsec and TLS require the same handshake protocol, making them interchangeable.

💡 Difficulty: easy | ✅ Correct: C

📖 Explanation: IPsec operates at the network layer and secures each IP packet, providing confidentiality, integrity, and authentication for the packet header as well as the payload. TLS, by contrast, works above the transport layer after a TCP connection is established, protecting only the data stream and not the routing information. Hence option C correctly contrasts the two.

Q5. When evaluating Authentication Header (AH) versus Encapsulating Security Payload (ESP) for a site-to-site VPN, which factor most strongly favors choosing ESP over AH?

A.AH provides encryption, while ESP only offers authentication.

B.ESP can encrypt payloads and also provide authentication, whereas AH offers only authentication without encryption. ✅

C.AH supports NAT traversal, but ESP does not.

D.ESP requires fewer cryptographic operations than AH, reducing processing overhead.

💡 Difficulty: medium | ✅ Correct: B

📖 Explanation: ESP offers both encryption of the payload and optional authentication, while AH provides only authentication without encrypting the data. When confidentiality is required—especially to hide the payload from eavesdroppers—ESP is preferred. This advantage, combined with its ability to operate with NAT‑Traversal, makes option B the strongest factor favoring ESP over AH.

Q6. In transport mode versus tunnel mode of IPsec, which statement accurately describes the impact on packet overhead and routing visibility?

A.Transport mode adds an extra IP header, increasing overhead, while tunnel mode leaves the original header unchanged.

B.Tunnel mode encrypts only the payload, whereas transport mode encrypts the entire original packet.

C.Transport mode hides the original source and destination addresses, while tunnel mode reveals them to intermediate routers.

D.Transport mode keeps the original IP header visible for routing, adding minimal overhead, whereas tunnel mode encapsulates a new IP header, increasing overhead but concealing the original addresses. ✅

💡 Difficulty: hard | ✅ Correct: D

📖 Explanation: In transport mode, IPsec encrypts only the payload and leaves the original IP header exposed, so routers can still route the packet with minimal added overhead (typically 20‑30 bytes). Tunnel mode encapsulates the entire original packet inside a new IP header, increasing overhead and concealing the original source and destination addresses, which matches option D.

Q7. How does the anti‑replay window mechanism in IPsec protect against replay attacks?

A.It maintains a sliding window of sequence numbers to detect and reject packets that have already been processed. ✅

B.It encrypts the packet payload to prevent replay.

C.It uses a checksum to verify packet integrity.

D.It forces the sender to wait for an acknowledgment before transmitting the next packet.

💡 Difficulty: easy | ✅ Correct: A

📖 Explanation: The anti‑replay window maintains a record of recent sequence numbers for received packets. When a packet arrives, its sequence number is checked against this sliding window; if it falls within the window and has already been seen, the packet is discarded as a replay. This detection mechanism is described in option A.

Q8. Network Address Translation (NAT) traversal is often required for ESP packets. Which relationship best describes the interaction between NAT and ESP?

A.NAT modifies the ESP header, causing decryption failures.

B.ESP packets are unaffected by NAT because they do not contain port numbers.

C.NAT changes the outer IP address, which can break ESP’s integrity check unless NAT‑Traversal (NAT‑T) encapsulates ESP in UDP. ✅

D.NAT automatically encrypts ESP payloads, enhancing security.

💡 Difficulty: medium | ✅ Correct: C

📖 Explanation: ESP packets lack port numbers, which prevents traditional NAT devices from creating proper translation entries. When NAT modifies the outer IP address, the ESP integrity check may fail unless NAT‑Traversal encapsulates the ESP payload within UDP, allowing the NAT device to map the flow correctly. This relationship is captured in option C.

Q9. Designing a secure hybrid network where hosts communicate through routers, which combination of network-layer security features provides the most comprehensive protection against eavesdropping, spoofing, and traffic analysis?

A.Apply only AH on routers and ESP on hosts.

B.Use ESP in tunnel mode between routers, combined with anti‑replay windows and IPsec policies on hosts. ✅

C.Deploy TLS over TCP for all traffic and ignore IPsec.

D.Rely solely on firewall ACLs without IPsec.

💡 Difficulty: hard | ✅ Correct: B

📖 Explanation: Deploying ESP in tunnel mode between routers ensures that the entire original IP packet, including routing headers, is encrypted and authenticated, protecting against eavesdropping and spoofing. Adding anti‑replay windows on both routers and hosts further prevents replay attacks, while IPsec policies enforce consistent security associations, providing comprehensive protection as described in option B.

Q10. What is the primary purpose of network-layer security in the OSI model?

A.To ensure reliable data transmission.

B.To provide physical medium access control.

C.To manage session establishment.

D.To protect IP packets against eavesdropping, tampering, and spoofing. ✅

💡 Difficulty: medium | ✅ Correct: D

📖 Explanation: Network‑layer security aims to safeguard IP packets as they traverse the network by providing confidentiality, integrity, and authentication. This prevents unauthorized parties from reading, altering, or forging packets, thereby protecting communications against eavesdropping, tampering, and spoofing. Option D accurately states this primary purpose.

🔗 Related Topics (MCQs)

📝 IPSec transport and tunnel modes: Two Modes MCQs 📝 IPSec AH and ESP Two Security Protocols MCQs 📝 IPSec security services MCQs 📝 Security Association in IPSec MCQs 📝 IKE Internet Key Exchange protocol MCQs

← Previous Topic📝 IPSec network layer securityIPSec transport and tunnel modes: Two Modes:Next Topic→