Free Huawei H12-711_V4.0 Practice Exam with Questions & Answers | Set: 5

Explanation From HCIA-Security documents:

IPsec secures user traffic mainly through the ESP or AH mechanisms, delivering a combination of confidentiality and authentication-related protections. Data encryption (A) provides confidentiality so that intercepted packets cannot be read by unauthorized parties. This is typically delivered by ESP using symmetric encryption algorithms negotiated during IKE.

For authentication, IPsec provides data origin authentication (B) , meaning the receiver can confirm that packets were generated by the expected peer (the holder of the correct IPsec SA and keys). Along with that, IPsec performs a data integrity check (D) so that any modification to the protected portion of a packet in transit is detected; integrity is commonly provided using an HMAC or authenticated encryption method.

Finally, IPsec also includes anti-replay (C) protection. By using sequence numbers and a replay window, the receiver can detect and discard duplicated old packets, which prevents attackers from capturing encrypted/authenticated traffic and retransmitting it to disrupt sessions or attempt misuse.

Because IPsec secure transmission depends on encryption plus authentication, integrity, and replay protection working together, all four options are correct.

Explanation From HCIA-Security documents:

In ESP transport mode, the authentication function provides data integrity and origin authentication for specific parts of the IP packet. The authentication calculation covers the ESP header, TCP/UDP header, user data, and ESP tail (including padding, Pad Length, and Next Header fields) . However, it does not include the outer IP header, because some IP header fields (such as TTL) may change during packet forwarding. It also does not include the ESP Authentication Data field itself, since that field stores the integrity check value result of the calculation.

In the diagram, range 3 correctly represents the portion starting from the ESP header up to the ESP tail, excluding the IP header and excluding the ESP Authentication Data field.

Range 1 only covers part of the payload, range 2 does not include the ESP header, and range 4 incorrectly includes the IP header. Therefore, option 3 accurately describes the authentication scope of ESP in transport mode.