IPsec SAs can be renegotiated or renewed at intervals. Which option best describes this?

• A. They are static for lifetime
• B. They can be renegotiated or renewed at intervals
• C. They never expire
• D. They are only for inbound traffic

Answer: (B)

IPsec SAs are not permanent; they’re created with a defined lifetime and can be replaced when that lifetime ends. This renegotiation, typically coordinated by IKE, refreshes the cryptographic keys used for both directions of the tunnel. Refreshing keys at intervals helps maintain security by limiting how long a single key is used and supports forward secrecy. So describing them as something that can be renegotiated or renewed at intervals aligns with how IPsec maintains secure communication. The other ideas don’t fit: SAs are not static for life, they do expire, and IPsec SAs apply to both inbound and outbound traffic, not just inbound.