Which of the following is a key feature of IPsec?

• A. The ability to decrypt any encrypted traffic on the fly.
• B. Application-level data integrity only.
• C. User authentication only.
• D. Mutual authentication, negotiation of cryptographic keys, protection of data flows between hosts or networks, and data confidentiality.

Answer: (D)

IPsec secures communications by authenticating peers, establishing cryptographic keys, protecting the data that travels between hosts or networks, and encrypting that data for confidentiality. The description that includes mutual authentication, key negotiation, protection of data flows, and data confidentiality matches the full scope of IPsec's capabilities, which is why it is the best choice. The other options misrepresent IPsec: decrypting encrypted traffic on the fly would violate confidentiality and is not a feature; claiming it provides only application-level integrity ignores its network-layer operation and encryption; and claiming only user authentication overlooks the essential roles of key exchange, data protection, and confidentiality.