A manufacturer connects plants with private MPLS and public internet. Compliance requires encrypted transport over internet, but operations wants lightweight overhead for native MPLS with no encryption. The WAN Edge routers support both encapsulations per tunnel. Which data plane encapsulation choice should the engineer apply to satisfy both transport requirements?
Select an answer to reveal the explanation.
Short Explanation
You match the wrapper to the road you are driving on. Public internet earns encryption while trusted private lines can run lean, and encapsulation-choice per color delivers exactly that split.
Full Explanation
The SD-WAN data plane supports IPsec, which adds encryption and integrity using keys derived through the control plane, and GRE, which provides simple encapsulation without encryption for trusted underlays where overhead matters. Applying IPsec to internet TLOCs protects data over untrusted transport while applying GRE to MPLS preserves throughput and avoids double encryption where physical privacy is already assured. Reversing them fails the concept because GRE over internet leaves compliance traffic exposed and IPsec over trusted MPLS adds unnecessary overhead against the operations goal. Using IPsec everywhere satisfies security but misses the stated lightweight requirement for MPLS and wastes router CPU. Using GRE everywhere satisfies overhead but misses the encryption requirement for internet and violates compliance. For the exam, remember encapsulation is negotiated per TLOC-color and IPsec is default, so GRE is an explicit optimization, and in practice verify the operational encapsulation per tunnel and confirm BFD still provides loss, latency and jitter regardless of wrapper.