A remote-access design team wants the client's transport to run over QUIC and wants tunneled user traffic carried through an HTTP/3 proxy. Which description of these technologies is correct?
Select an answer to reveal the explanation.
Short Explanation
Picture QUIC as a fast lane built on UDP with TLS 1.3 welded right into it, and MASQUE as the way you smuggle whole UDP or IP flows through an HTTP proxy riding on that lane. The trap is TCP — QUIC deliberately runs on UDP to dodge TCP's head-of-line blocking.
Full Explanation
QUIC is a transport protocol standardized by the IETF that runs over UDP and integrates TLS 1.3 into its handshake, so encryption and connection setup happen together, often in a single round trip. It multiplexes independent streams to avoid TCP's head-of-line blocking and supports connection migration when a client's address changes, which suits mobile remote-access users. HTTP/3 is HTTP carried over QUIC. MASQUE is the IETF effort that defines how to proxy traffic through HTTP: CONNECT-UDP carries UDP flows and CONNECT-IP carries full IP packets, which is how a client can tunnel user traffic through an HTTP/3 proxy that looks like ordinary web traffic. Describing QUIC as a TCP extension with TLS 1.2 is wrong on both counts, and MASQUE does not wrap ESP. QUIC is a transport, not a routing protocol, and MASQUE defines proxying methods rather than any certificate format. Calling QUIC TCP-based contradicts its design, and MASQUE is unrelated to DNS encryption, which is the role of DNS over HTTPS or DNS over QUIC. Exam caveat: because QUIC encrypts nearly all of its headers, middleboxes that inspect TCP traffic may need policy specific to UDP 443. Operational check: confirm the path permits UDP 443, and verify whether clients fall back to TCP-based TLS when UDP is blocked.