A financial firm must send branch internet traffic to a third-party Secure Internet Gateway over the public transport with encrypted tunnels and survive a gateway PoP outage without manual reconfiguration. Each branch has dual internet links. Which cloud security integration design provides encrypted SIG connectivity and redundancy?

Secure Internet Gateway integration extends branch internet-egress tunnels over public transports to cloud enforcement points, where IPsec provides confidentiality and authentication while dual PoP termination provides gateway and path redundancy through routing or DIA policy. Redundant IPsec to primary and secondary PoPs is correct because it satisfies both encryption and automatic survivability across gateway failures and transport issues. GRE without IPsec fails by concept because while GRE can carry traffic to the SIG and support redundancy, it lacks native encryption required for secure transport over the internet. A single tunnel over MPLS only fails by concept because it creates a single point of failure at the PoP and uses private transport rather than internet offload toward the SIG. TLS tunnels fail by concept because branch-to-SIG data-plane integration uses IPsec or GRE, not TLS session tunnels from routers. Exam caveat is to match the SIG vendor template for IKE, DPD andDIA NAT behavior, and practical check is to verify both tunnels are up and test PoP failover before migrating users.