A payroll transfer between two clinics must be encrypted on the IPsec path, not merely checked for tampering. Which protocol provides that encryption?
Select an answer to reveal the explanation.
Short Explanation
You need the envelope sealed, not just a wax stamp that shows nobody opened it. Encryption of the payload is Encapsulating Security Payload. Authentication Header can prove the packet was not altered and does not provide that confidentiality, and a plain encapsulation tunnel or a ping protocol does not become IPsec encryption.
Full Explanation
IPsec Encapsulating Security Payload encrypts the payload and can also authenticate it, which is what the clinics need so payroll contents are not readable on the path. Authentication Header authenticates the packet and does not encrypt the payload. The distractor reverses that split. A design that only needs integrity could consider Authentication Header. This stem requires encryption. Generic Routing Encapsulation wraps one packet inside another so it can cross an IP network. It does not encrypt, and it is not the IPsec protocol that provides confidentiality. ICMP is the control protocol used by tools such as ping. It does not encrypt a file transfer. Exam caveat: key exchange still has to happen, typically with IKE, before ESP can protect traffic. ESP is the protection, not the negotiation itself. Operational check: confirm the tunnel policy negotiates ESP, then capture on the outside path and verify the payroll payload is not readable. Check which transform the peers negotiated, and treat a policy that allows only Authentication Header as a miss for this payroll path.