A logistics firm connects two data centers over the Internet, needs encrypted voice plus dynamic routing with multicast for RP discovery, and must minimize overhead for small packets. Which IPsec versus GRE-over-IPsec tradeoff best meets this secure transport need?
Select an answer to reveal the explanation.
Short Explanation
You're torn between lean encryption and routing smarts across the Internet. GRE-over-IPsec wraps routing and multicast first, then encrypts, at the price of extra bytes on those tiny voice packets.
Full Explanation
Pure IPsec tunnel mode encrypts unicast IP payloads efficiently but does not encapsulate multicast or non-IP protocols, so dynamic routing protocols and PIM discovery requiring multicast cannot traverse it natively, while GRE provides the multipoint-capable encapsulation that carries those protocols and IPsec adds confidentiality, at the cost of combined GRE plus IPsec headers. Claiming IPsec alone carries multicast with minimal overhead is conceptually wrong because the limitation is protocol support, not overhead. GRE without IPsec supports routing and multicast but provides no encryption, violating the requirement for encrypted voice over the Internet. Using IPsec alone with static routes avoids headers but sacrifices dynamic routing resilience and still cannot carry multicast-based RP discovery without tunneling. For the exam, remember tunnel mode equals encryption without multicast and GRE-over-IPsec equals encryption plus routing at extra overhead; in practice measure MTU and adjust TCP MSS to accommodate the stacked headers.