In IPSec, if the communication mode is gateway-gateway or host-gateway:

A.
Only tunnel mode can be used

B.
Only transport mode can be used

C.
Encapsulating Security Payload (ESP) authentication must be used

D.
Both tunnel and transport mode can be used

Explanation:
“IPSec can work in one of two modes: transport mode, where the payload of the message is
protected, and tunnel mode, where the payload and the routing and header information is
protected.” Pg 527 Shon Harris: All-in-One CISSP Certification Not:” Encapsulating Security Payload
(ESP) authentication must be used” “IPSec is not a strict protocol that dictates the type of algorithm,
keys, and authentication method to be used, but it is an open, modular framework that provides a
lot of flexibility for companies when they choose to use this type of technology. IPSec uses two basic
security protocols: Authentication Header (AH) and the Encapsulating Security Payload (ESP). AH is
the authenticating protocol, and ESP is an authenticating and encrypting protocol that uses

cryptographic mechanisms to provide source authentication, confidentiality, and message integrity.”
Pg 527 Shon Harris: All-in-One CISSP Certification