In IPsec, which mode encrypts the entire IP packet including the header?

• A. Tunnel mode
• B. Transport mode
• C. AH
• D. ESP

Answer: (A)

In IPsec, how protection is applied depends on the mode chosen. In transport mode, IPsec secures only the payload of the IP packet, leaving the IP header visible. In tunnel mode, the entire original IP packet—header and payload—is wrapped inside a new IP packet, and IPsec provides encryption and authentication for that whole inner packet. That makes tunnel mode the one that encrypts the entire IP packet, including the header. AH offers authentication without encryption, so it doesn’t provide confidentiality. ESP handles encryption (and optional authentication) but is the mechanism used within either mode, and it’s the mode choice that determines whether the whole packet is encrypted.