An organization deploys network-based encryption between all internal hosts using IPsec in tunnel mode. Which security monitoring challenge does this create?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Here's the deal — c is correct because IPsec tunnel mode encrypts packet payloads, preventing DPI engines and signature-based IDS from inspecting content. A is wrong because ARP operates at Layer 2 before IPsec encryption and is still visible.
Full explanation below image
Full Explanation
C is correct because IPsec tunnel mode encrypts packet payloads, preventing DPI engines and signature-based IDS from inspecting content. A is wrong because ARP operates at Layer 2 before IPsec encryption and is still visible. B is wrong because flow metadata (source, destination, port, volume) remains visible even with IPsec. D is wrong because stateful firewalls track connection state using IP headers, which remain visible in IPsec transport mode.