In IPsec, which statement best describes host-to-host versus network-to-network?

In IPsec, which statement best describes host-to-host versus network-to-network?

• A. Host-to-host secures data flows between two individual hosts; network-to-network secures data flows between two security gateways.
• B. Host-to-host secures data flows between a host and a network gateway; network-to-network secures data flows between two hosts.
• C. Host-to-host secures data flows within a single network; network-to-network secures data flows outside the network.
• D. Host-to-host is for application-level security; network-to-network is for transport-level security.

Answer: (A)

IPsec covers two common deployment styles: end-to-end connections between two hosts and site-to-site connections between two networks. In the end-to-end case, two hosts negotiate a security association and protect the traffic directly between them, typically using transport mode, where only the payload is encrypted or authenticated and the original IP header remains for routing. In the site-to-site case, gateways at each network edge establish a tunnel, protecting all traffic crossing the site boundary; this uses tunnel mode so the entire original IP packet is encapsulated inside a new header, letting whole networks communicate securely across an insecure network like the Internet. This aligns with describing end-to-end host-to-host communications and site-to-site network-to-network communications between security gateways. The other statements mix up who is protected (between hosts vs gateways) or the mode and layer, which doesn’t match how IPsec is designed to operate.

IPsec covers two common deployment styles: end-to-end connections between two hosts and site-to-site connections between two networks. In the end-to-end case, two hosts negotiate a security association and protect the traffic directly between them, typically using transport mode, where only the payload is encrypted or authenticated and the original IP header remains for routing. In the site-to-site case, gateways at each network edge establish a tunnel, protecting all traffic crossing the site boundary; this uses tunnel mode so the entire original IP packet is encapsulated inside a new header, letting whole networks communicate securely across an insecure network like the Internet.

This aligns with describing end-to-end host-to-host communications and site-to-site network-to-network communications between security gateways. The other statements mix up who is protected (between hosts vs gateways) or the mode and layer, which doesn’t match how IPsec is designed to operate.