Exam 312-49v10 topic 1 question 178 discussion

Actual exam question from ECCouncil's 312-49v10

Question #: 178
Topic #: 1

After passing her CEH exam, Carol wants to ensure that her network is completely secure. She implements a DMZ, stateful firewall, NAT, IPSEC, and a packet filtering firewall. Since all security measures were taken, none of the hosts on her network can reach the Internet. Why is that?

A. Stateful firewalls do not work with packet filtering firewalls
B. NAT does not work with stateful firewalls
C. IPSEC does not work with packet filtering firewalls
D. NAT does not work with IPSEC

Show Suggested Answer

Suggested Answer: D 🗳️

by BarryMacockener at Nov. 10, 2022, 4:17 p.m.

Comments

Submit Cancel

044f354

3 months, 3 weeks ago

Selected Answer: D

Answer: D 1. IPSEC uses AH (Authentication Header) and ESP (Encapsulating Security Payload), both of which rely on packet integrity. 2. NAT modifies packet headers, causing integrity checks to fail. [unless NAT-T (NAT Traversal) is implemented, which is not mentioned in this scenario.] (A) ❌ Stateful and packet filtering firewalls can work together. (B) ❌ NAT and stateful firewalls are compatible. (C) ❌ IPSEC can work with packet filtering firewalls if properly configured. (D) ✅ NAT modifies packet headers, breaking IPSEC authentication unless NAT-T is used.

upvoted 1 times

...

BarryMacockener

7 months, 4 weeks ago

For what it's worth, this is a VERY outdated question. D used to be correct, but NAT has been compatible with IPSec for a couple years now.

upvoted 2 times

...