Which of the following statements about IPsec usage is true?

• A. IPsec can be used to secure communications between two machines
• B. IPsec can be used to secure communications between two networks
• C. IPsec network traffic is always encrypted
• D. IPsec cannot provide authentication

Answer: (B)

IPsec protects IP traffic by providing authentication and optional encryption, making it a versatile tool for securing communications at the network layer. The most common deployment is to connect two networks securely over an untrusted network, using tunnel mode so traffic from one network to the other is encapsulated and protected as it travels between gateways. This site-to-site, network-to-network use is why the statement about securing communications between two networks is the best fit. It reflects the typical, scalable way IPsec is used to create a secure link between networks.

IPsec can also be configured for host-to-host communications, but the scenario described in practice tends to emphasize the network-to-network setup, which is why that option is the most representative answer. Regarding the other points, IPsec does provide authentication, so saying it cannot do so isn’t accurate. And while IPsec can encrypt traffic, authentication and integrity can be achieved without encryption in some configurations (for example, when using authentication-only options), so the statement that network traffic is always encrypted isn’t correct.