Which of the following is a direct target for policy enforcement in the context of the source material?

• A. SSL/TLS
• B. IPsec security associations
• C. Both SSL/TLS and IPsec security associations
• D. Neither SSL/TLS nor IPsec security associations

Answer: (B)

Policy enforcement focuses on the mechanisms that actually carry and protect data in transit. IPsec uses security associations as the live, enforceable channels that provide encryption, integrity, and anti-replay protection. A policy in a gateway or firewall is applied to traffic and determines which IPsec SA to use for securing that traffic, including the cryptographic parameters and keys. SSL/TLS, by contrast, is an end-to-end protocol negotiated between endpoints for securing a specific session; it’s not the direct channel that policy enforcement installs or manages within the network devices. So the direct target for policy enforcement is the IPsec security associations.