A retailer has 400 spokes with full-mesh policy but most stores rarely call each other, and operations wants fewer idle IPsec tunnels to save resources while keeping direct spoke-to-spoke voice optimal when needed. Spokes already have control connections and data-plane reachability. Which on-demand tunnel behavior achieves direct optimal forwarding only when traffic appears?

With 400 spokes under full-mesh policy where inter-store voice is rare, keeping hub paths active for initial control and first packets while installing a direct spoke-to-spoke IPsec tunnel only upon data-plane traffic detection delivers optimal media without permanent mesh overhead, and the idle timeout then tears down unused tunnels to save resources, which is possible because control connections and data-plane reachability already exist. The hub-forwarding design with dynamic path selection is operationally common for centralized inspection and visibility, yet it hairpins voice through the hub and cannot meet the explicit direct optimal-forwarding need for latency-sensitive media. The control-route-triggered design that builds direct tunnels as soon as prefixes are advertised is also widely used to pre-warm paths, but it creates tunnels before any traffic appears and therefore reintroduces the idle-tunnel scale problem the scenario seeks to avoid. The retain-persistently design correctly uses traffic-triggered direct tunnels but defeats the resource goal by never aging them out, which suits frequently meshed sites rather than rarely calling stores. For exams, focus on trigger wording: only data traffic versus route advertisement versus always-on changes idle state and optimality, and for practice verify configured idle timeout, generate test inter-spoke voice, then confirm direct tunnel creation, media path, and automatic removal after inactivity.