Two firewalls at a bank must negotiate keys and security associations before encrypted payloads can flow. Which protocol performs that negotiation?
Select an answer to reveal the explanation.
Short Explanation
Before you lock the briefcase you have to agree on the combination. That agreement, for an IPsec path, is Internet Key Exchange. Wrapping a packet, stamping it for integrity, or sending a ping does not negotiate the keys your firewalls need.
Full Explanation
Internet Key Exchange negotiates the security associations and keys that IPsec will use. The bank firewalls must complete that negotiation before encrypted payloads can flow, so IKE is the protocol that fits. Generic Routing Encapsulation tunnels packets. It does not negotiate IPsec keys. Authentication Header can authenticate packets and does not perform the key agreement, and it does not encrypt. ICMP carries control messages such as echo requests. It does not build IPsec security associations. Exam caveat: IKE uses UDP 500, and NAT traversal often adds UDP 4500, but the exam point here is the role, not a port to memorize in isolation. Operational check: confirm both firewalls agree on the IKE policy, watch the negotiation succeed, and only then check that payloads are protected. If the negotiation fails, compare the proposal on each firewall before you look at the encrypted traffic that cannot exist yet. Capture the negotiation only long enough to see which proposal is rejected. Then apply the matching proposal.