IPsec Tunnel Mode Encrypts the Entire Original Datagram

Describe IPsec remote access and site-to-site VPNs
Answer Correct answer: A — In IPsec tunnel mode the entire original IP datagram is encrypted and a new IP header is added to carry it to the tunnel endpoint.

Which factor must be considered during the implementation of an IPsec VPN?

  1. In IPsec tunnel mode, the entire original IP datagram is encrypted. Correct Answer
  2. IPsec transport mode increases GRE tunnel security over tunnel mode.
  3. In IPsec tunnel mode, only the IP payload is encrypted.
  4. IPsec transport mode leaves the Layer 4 header unencrypted for inspection.

Community Votes

A
100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tunnel mode = encrypt everything (original IP header included) + new outer IP header; transport mode = encrypt payload only, original IP header preserved.

IPsec tunnel mode encrypts the whole original IP packet (header and payload) and wraps it with a new IP header, used for site-to-site and remote-access VPNs. Transport mode encrypts only the payload (L4 and up) and keeps the original IP header. GRE is a separate tunneling protocol, not made more secure by transport mode.

Picking C (that describes transport mode, not tunnel) or D (transport mode encrypts the L4 header too). B wrongly ties transport mode to GRE security.

Community Discussion (8 comments)

DingoHunter 👍 14
10.16.24 today. I passed mine a few days ago using the questions up to here. The questions on my exam matched the old objectives, not the CCNA "V1." I saw Puppet and Chef questions, but none about Terraform. Use the dump questions wisely. The user comments are valuable.
MicroDiff 👍 5
Dears, I passed my CCNA exam yesterday, approximately 65% of this dump appeared on the exam. I focused on study separating the questions: drag and drops, mutiple choice and labs. Good luck to everyone!
schewinski 👍 1 Selected: A
PQP ACABEI ESSA PORRA!!!!!!!!! BOA SORTE CACHORADA RAWWRRR
juniorsgk 👍 2
My last question!! Today 03.13.2025
3d3b1c9 👍 3 Selected: A
El final del camino, les deseo suerte a todos.
exiledwl 👍 2 Selected: A
Definitely A
MicroDiff 👍 3 Selected: A
The correct answer is A, the entire datagram is encrypted
Rushit23 👍 4
A. In IPsec tunnel mode, the entire original IP datagram is encrypted.

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

A is correct. IPsec tunnel mode encrypts the entire original IP datagram (header and payload) and adds a new IP header for delivery to the tunnel endpoint.

Why the Other Options Are Wrong

B is wrong: transport mode does not increase GRE security; GRE and IPsec are distinct. C is wrong: encrypting only the payload describes transport mode, not tunnel. D is wrong: transport mode encrypts the Layer 4 header along with the payload.

Community Comment Notes

The vote is A (100). Commenters confirm 'the entire datagram is encrypted' in tunnel mode.

Official Reference

https://learningnetwork.cisco.com/s/ccna-exam-topics

Related Analysis

Refer to the exhibit. Router-WAN1 has a new connection via G

A-Grade

Which Rapid PVST+ port state does a port operate in without

S-Grade

How does MAC learning function?

A-Grade

Practice All 200-301 Questions

Access 220 questions with complete answers and detailed explanations.

View Full 200-301 Practice Test →

← Back to 200-301 Study Guide