In IPsec, which mode encrypts only the payload?

• A. Tunnel mode
• B. Transport mode
• C. AH
• D. ESP

Answer: (B)

IPsec protects data in two ways: transport mode and tunnel mode. In transport mode, only the payload is encrypted and/or authenticated, while the original IP header remains in the clear so the packet can be routed normally. This makes transport mode ideal when end hosts communicate directly and you want confidentiality for the payload without hiding the addressing information. ESP handles the encryption, and it can work in transport mode to secure just the payload (or in tunnel mode to secure the entire original packet and add a new header). AH provides authentication without encryption, so it doesn’t encrypt the payload. Therefore, the mode that encrypts only the payload is transport mode.