What are the two main IPsec modes and how do they differ?

• A. Transport mode protects only the payload; Tunnel mode protects the entire IP packet and is used for VPN gateways.
• B. Transport mode encrypts headers; Tunnel mode encrypts only payload.
• C. There are three modes: Transport, Tunnel, and Hybrid; all treat IP packets the same.
• D. IPsec defines authentication only without encryption.

Answer: (A)

Two main IPsec modes determine how much of the original IP packet is protected and where the security is applied. In transport mode, IPsec protects only the payload of the original IP packet, while the IP header remains unchanged and visible. This supports end-to-end security between two hosts, preserving the original addressing and routing information. In tunnel mode, the entire original IP packet (header and payload) is encapsulated inside a new IP packet, with a new header added for the tunnel. The original packet is encrypted and authenticated inside, which hides internal addresses and is ideal for connecting networks over untrusted networks, such as between VPN gateways.

So the best answer reflects that transport mode secures just the payload, while tunnel mode secures the whole packet and is used for VPN gateways. The other statements are incorrect because there aren’t three modes, headers aren’t encrypted in transport mode, and IPsec provides both encryption and authentication, not authentication only.