A logistics firm runs encrypted SD-WAN over DIA and private MPLS where voice needs confidentiality on Internet but legacy probes on MPLS need unencrypted encapsulation for inspection. The design must preserve overlay routing while matching per-transport security needs. Which data plane encapsulation choice correctly applies IPsec versus GRE for this traffic?
Select an answer to reveal the explanation.
Short Explanation
You matched protection to the transport instead of forcing one tunnel everywhere. Keep encapsulation tied to trust and inspection needs on each path.
Full Explanation
The correct design maps encapsulation to transport trust while preserving SD-WAN logic, as IPsec supplies confidentiality, integrity and authentication for voice across untrusted Internet DIA, GRE supplies lightweight unencrypted encapsulation for legacy probes across trusted private MPLS where inspection requires cleartext visibility, and retaining overlay headers preserves VPN segmentation, TLOC identity and centralized application-aware routing. One incorrect choice inverts that mapping with GRE on Internet and IPsec on MPLS, which keeps overlay routing but exposes voice to eavesdropping on the public underlay while adding needless crypto overhead and opacity to probe traffic that was meant to stay inspectable. Another incorrect choice encrypts both transports with IPsec for uniform zero-trust simplicity, which secures voice and retains overlay yet violates the MPLS visibility mandate because encrypted probes cannot be parsed by legacy inspection systems. The remaining incorrect choice uses the right IPsec-versus-GRE split but forwards on underlay native routing without overlay lookup, which appears efficient but discards segmentation, policy enforcement and transport-aware path control that overlay headers provide. For exams, do not assume universal encryption is ideal when the scenario explicitly requires selective cleartext inspection. As a practical check, confirm ESP for DIA voice, plain GRE for MPLS probes, and intact overlay VPN headers in captures and device tunnel tables.