A retailer connects 40 stores to headquarters over the Internet, needing EIGRP routing updates and multicast inventory feeds over encrypted paths while accepting extra overhead. A second project needs simple site-to-site encryption for unicast file transfer only. Which IPsec versus GRE-over-IPsec tradeoff guides the design?

GRE-over-IPsec fits the stores because GRE encapsulates EIGRP packets and IP multicast inventory feeds, which native IPsec alone does not carry in this design; IPsec then encrypts and protects the traffic across the Internet, with extra headers and overhead accepted. For unicast-only file transfers, IPsec tunnel mode provides gateway-to-gateway encryption without adding GRE, keeping the configuration simpler and avoiding that extra overhead. Using IPsec tunnel mode alone for both projects fails because it does not provide the GRE encapsulation needed to carry the stores’ multicast feeds and EIGRP updates, so EIGRP adjacencies would not form. Using GRE-over-IPsec for the stores but IPsec transport mode for file transfers is a poor fit: transport mode protects the payload while retaining the original IP header, rather than providing the standard gateway-to-gateway tunnel mode needed for this site-to-site design. Using a remote-access SSL VPN for the file-transfer project also misses the requirement: it is designed for user or client access, not always-on site-to-site gateway peering. Exam caveat: when a question requires multicast or routing protocols over encrypted links, look for GRE-over-IPsec rather than native IPsec alone. Practical check: verify that IPsec security-association counters increase and that EIGRP neighbors and multicast routes are present.