Which of the following is a direct target for policy enforcement among security controls?

• A. SSL/TLS certificates
• B. IPsec security associations
• C. Both SSL/TLS certificates and IPsec security associations
• D. Neither SSL/TLS certificates nor IPsec security associations

Answer: (B)

Policy enforcement in security controls focuses on how traffic is protected and which communications are allowed. IPsec security associations are the mechanism that actually implements that policy by specifying the negotiated protections for a flow—things like which algorithms to use, the encryption keys, and the SPI values that tie a packet to a protected channel. When a policy requires traffic to be secured through IPsec, the enforcement point applies and honors these SAs to ensure only properly protected traffic passes, and to guarantee it’s encrypted and integral as dictated.

SSL/TLS certificates, on the other hand, are essential for authenticating peers and establishing a TLS session, but they’re not the thing the policy enforces on every packet. The enforcement happens through the established security association parameters that govern the protected channel. That’s why the direct target for policy enforcement among these security controls is the IPsec security associations.