In an IPsec connection between two parties, how many security associations are typically used to cover bidirectional traffic?

• A. One
• B. Two
• C. Three
• D. Four

Answer: (B)

In IPsec, a security association is unidirectional. Each SA secures traffic in one direction—from one endpoint to the other—with its own SPI, keys, and cryptographic parameters. To cover bidirectional traffic between two peers, you typically have a pair of SAs: one for traffic from A to B and another for traffic from B to A. They can share the same algorithms and lifetimes, but they are distinct SAs because each direction requires its own security context. That's why two SAs are the common, minimal setup for bidirectional communication.