CompTIA SecurityX (CAS-005)Security ArchitectureEasy
A security architect is designing a secure communication channel between two geographically distant data centers that host critical business applications. The channel must provide strong encryption, data integrity, and authentication for all IP traffic. Which protocol suite is BEST suited for this purpose?
- AIPsec.
- BSSH.
- CSSL/TLS.
- DSFTP.
Show answer & explanationAnswer & explanation
Correct answer: A. IPsec.
IPsec (Internet Protocol Security) is a suite of protocols that provides cryptographic protection for IP packets at the network layer. It offers strong encryption, data integrity, and authentication for all traffic between two endpoints, making it ideal for securing site-to-site VPNs between data centers.
Why the other options are wrong
- B. SSH (Secure Shell) provides secure remote access and command execution, not a general-purpose secure channel for all IP traffic between data centers.
- C. SSL/TLS primarily secures application-layer traffic (e.g., HTTPS), not all IP traffic at the network layer between data centers.
- D. SFTP (SSH File Transfer Protocol) is for secure file transfer, not for securing all network traffic between two sites.
IPsec
IPsec (Internet Protocol Security) is a suite of protocols used to secure IP communications by authenticating and encrypting each IP packet of a communication session. It operates at the network layer (Layer 3).
- Provides confidentiality, integrity, and authenticity for IP traffic.
- Used for Virtual Private Networks (VPNs), especially site-to-site.
- Consists of two main protocols: AH (Authentication Header) and ESP (Encapsulating Security Payload).
- Operates in two modes: Transport mode (end-to-end) and Tunnel mode (gateway-to-gateway).
Memory trick: IPsec secures the entire IP journey between sites.