IPsec Tunnel Mode Encrypts the Entire Original Datagram

200-301 By islever Editorial Last updated Sep 30, 2026

Describe IPsec remote access and site-to-site VPNs

Short answer

A In IPsec tunnel mode the entire original IP datagram is encrypted and a new IP header is added to carry it to the tunnel endpoint.

Question

Which factor must be considered during the implementation of an IPsec VPN?

In IPsec tunnel mode, the entire original IP datagram is encrypted. Correct Answer
IPsec transport mode increases GRE tunnel security over tunnel mode.
In IPsec tunnel mode, only the IP payload is encrypted.
IPsec transport mode leaves the Layer 4 header unencrypted for inspection.

Key Takeaways

Tunnel mode = encrypt everything (original IP header included) + new outer IP header; transport mode = encrypt payload only, original IP header preserved.

IPsec tunnel mode encrypts the whole original IP packet (header and payload) and wraps it with a new IP header, used for site-to-site and remote-access VPNs. Transport mode encrypts only the payload (L4 and up) and keeps the original IP header. GRE is a separate tunneling protocol, not made more secure by transport mode.

Common mistake: Picking C (that describes transport mode, not tunnel) or D (transport mode encrypts the L4 header too). B wrongly ties transport mode to GRE security.

Expert Analysis

Why the Answer Is Correct

A is correct. IPsec tunnel mode encrypts the entire original IP datagram (header and payload) and adds a new IP header for delivery to the tunnel endpoint.

Why the Other Options Are Wrong

B is wrong: transport mode does not increase GRE security; GRE and IPsec are distinct. C is wrong: encrypting only the payload describes transport mode, not tunnel. D is wrong: transport mode encrypts the Layer 4 header along with the payload.

Community Comment Notes

The vote is A (100). Commenters confirm 'the entire datagram is encrypted' in tunnel mode.

Official Reference

https://learningnetwork.cisco.com/s/ccna-exam-topics

This link opens the official vendor documentation in a new tab.

Community Votes

100%

100% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

DingoHunter 👍 14

10.16.24 today. I passed mine a few days ago using the questions up to here. The questions on my exam matched the old objectives, not the CCNA "V1." I saw Puppet and Chef questions, but none about Terraform. Use the dump questions wisely. The user comments are valuable.
MicroDiff 👍 5

Dears, I passed my CCNA exam yesterday, approximately 65% of this dump appeared on the exam. I focused on study separating the questions: drag and drops, mutiple choice and labs. Good luck to everyone!
Rushit23 👍 4

A. In IPsec tunnel mode, the entire original IP datagram is encrypted.
MicroDiff 👍 3 Answered A

The correct answer is A, the entire datagram is encrypted
3d3b1c9 👍 3 Answered A

El final del camino, les deseo suerte a todos.

Show 3 more comments

juniorsgk 👍 2

My last question!! Today 03.13.2025
schewinski 👍 1 Answered A

PQP ACABEI ESSA PORRA!!!!!!!!! BOA SORTE CACHORADA RAWWRRR
exiledwl 👍 2 Answered A

Definitely A

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All 200-301 Questions

Access 220 questions with complete answers and detailed explanations.

View Full 200-301 Practice Test →

← Back to 200-301 Study Guide