An organization deploys network-based encryption between all internal hosts using IPsec in tunnel mode. Which security monitoring challenge does this create?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — c is correct because IPsec tunnel mode encrypts packet payloads, preventing DPI engines and signature-based IDS from inspecting content. A is wrong because ARP operates at Layer 2 before IPsec encryption and is still visible.
Full Explanation
C is correct because IPsec tunnel mode encrypts packet payloads, preventing DPI engines and signature-based IDS from inspecting content. A is wrong because ARP operates at Layer 2 before IPsec encryption and is still visible. B is wrong because flow metadata (source, destination, port, volume) remains visible even with IPsec. D is wrong because stateful firewalls track connection state using IP headers, which remain visible in IPsec transport mode.