Which component of IPsec performs protocol-level functions that are required to encrypt and decrypt the packets?

Internet Key Exchange (IKE) https://en.wikipedia.org/wiki/Internet_Key_Exchange Internet Key Exchange (IKE, sometimes IKEv1 or IKEv2, depending on version) is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP. IKE uses X.509 certificates for authentication ‒ either pre-shared or distributed using DNS (preferably with DNSSEC) ‒ and a Diffie–Hellman key exchange to set up a shared session secret from which cryptographic keys are derived. Incorrect answers: Oakley - the Oakley Key Determination Protocol is a key-agreement protocol that allows authenticated parties to exchange keying material across an insecure connection using the Diffie– Hellman key exchange algorithm. The protocol was proposed by Hilarie K. Orman in 1998, and formed the basis for the more widely used Internet Key Exchange protocol. IPsec Policy Agent - service provides end-to-end security between clients and servers on TCP/IP networks, manages IPsec policy settings, starts the Internet Key Exchange (IKE), and coordinates IPsec policy settings with the IP security driver. IPsec driver - wrong!