Policy enforcement can be applied to which of the following in a typical network security architecture?

• A. SSL/TLS
• B. IPsec security associations
• C. Both SSL/TLS and IPsec security associations
• D. Neither SSL/TLS nor IPsec security associations

Answer: (B)

Policy enforcement in a network security setup relies on concrete decisions about which traffic to protect and how. IPsec is built around that idea: a device uses a Security Policy Database to decide which flows should be secured and a Security Association Database to hold the actual encryption and authentication parameters. When traffic matches a policy, the device enforces it by establishing and using an IPsec security association to protect that traffic. This direct, policy-driven control of how traffic is secured is why policy enforcement is applied to IPsec security associations. In contrast, SSL/TLS operates end-to-end between client and server, with encryption negotiated by the endpoints; network devices can influence TLS usage, but they don’t enforce encryption state in the same centralized way as IPsec SAs. That makes IPsec security associations the best fit for policy enforcement in the typical architecture.