A branch WAN Edge has two ISP links that must be distinguished as biz-internet and public-internet colors, carry IPsec with GRE fallback, and allow only HTTPS and SSH for management from the overlay. The engineer must configure the transport interfaces correctly. Which transport interface configuration on the WAN Edge router fulfills this color, encapsulation, and service requirement?
Select an answer to reveal the explanation.
Short Explanation
You're lighting up two ISPs that must stay distinct, secure, and locked down to safe management. Tunnel interfaces with colors and encapsulation plus tight allowed services nail all three at once.
Full Explanation
The correct configuration succeeds because SD-WAN transport tunnel interfaces must explicitly bind each ISP to its intended color to drive control and data policy, enable both IPsec and GRE encapsulations so the edge can build tunnels with peers that support either, and constrain management-plane access to only HTTPS and SSH to reduce attack surface while preserving controller and CLI access. The alternative that reuses biz-internet on both transports fails on color concept because identical colors cause the controller to treat distinct ISPs as equivalent paths and prevent selective steering, SLA enforcement, and fault isolation expected between business and public Internet. The alternative that disables GRE fails on encapsulation concept because IPsec-only removes GRE tunnel capability, so peers that offer only GRE encapsulation could not form tunnels with this edge. The alternative that adds NETCONF alongside HTTPS and SSH fails on service hardening concept because any additional allowed service expands the overlay-exposed management plane beyond the stated allowlist, violating least-privilege even though NETCONF is routine in centralized management. For exam purposes, remember that color, encapsulation, and allowed services are independent tunnel-interface attributes and a question that asks for all three requires all three to be exact, so a familiar best practice that improves one area still scores as incorrect. In practice, verify with show sdwan running-config plus show control connections and attempt management from both colors to confirm reachability is limited to the intended ports.