Site-to-site VPNs typically decrypt messages when they arrive from the outside.

• A. True
• B. False
• C. Not applicable
• D. Cannot determine

Answer: (A)

Site-to-site VPNs create a secure tunnel between two gateways at the edges of separate networks. The sending gateway encrypts and encapsulates the traffic before it traverses the public network, and the receiving gateway decrypts that traffic as it arrives, then forwards the original packets into the remote internal network. This use of tunnel mode means decryption happens at the VPN endpoints on the outside, not at the hosts inside the networks. So the statement is true because the decryption occurs at the gateway at the far end of the tunnel as the encrypted data arrives from the outside.