A bank runs a private MPLS core to 60 branches with low-latency voice needing any-to-any encryption without per-tunnel overhead and centralized key policy. Internet backhaul is prohibited for this traffic. Which GET VPN group key model fits the private transport requirement?

GET VPN with centralized key servers is correct because group members share a common security association and encrypt original packets while preserving IP headers, allowing any-to-any voice to ride native MPLS forwarding without building pairwise tunnels, which keeps latency and jitter low and lets centralized rekey and access policy scale efficiently to 60 sites over private transport. The FlexVPN approach fails by tunneling concept because IKEv2 point-to-point IPsec requires per-pair security associations and encapsulation, reintroducing tunnel setup, added header overhead and N-squared scaling that the scenario explicitly forbids for low-latency voice. The hop-by-hop MACsec approach fails by key-management concept because link-layer encryption terminates on each physical hop and depends on carrier cooperation, so it cannot provide end-to-end group encryption with centralized group policy across branches. The Internet-based GET VPN approach fails by transport concept because although the cryptography and group model are sound and widely deployed, carrying bank voice over public transport violates the explicit prohibition on Internet backhaul for compliance and performance isolation. As an exam caveat, distinguish tunnel-preserving versus tunnel-less group encryption and remember that GET VPN still needs routable control-plane reachability to key servers via the private core, not via data-plane Internet. As a practical check, validate redundant key servers, GDOI registration, periodic rekey behavior, MPLS QoS preservation for EF voice, and that group-member counters show group-encrypted packets without tunnel interfaces incrementing.