A campus IOS XE router must send internet-bound traffic to a secure internet gateway. That gateway's current guide says to terminate plain GRE from the campus, not IPsec. Which tunnel should the engineer configure?
Select an answer to reveal the explanation.
Short Explanation
Use the door the gateway actually built: you configure the GRE tunnel its guide specifies, aimed at the secure internet gateway. An AWS virtual private gateway sends traffic to a VPC, an OSPF adjacency across the campus LAN does not attach you to the gateway, and a management-host crypto map does not carry users’ internet traffic.
Full Explanation
Objective 3.1 includes a secure internet gateway as a far end, and that far end dictates the encapsulation. This gateway’s guide says plain GRE, so the IOS XE router builds a GRE tunnel to the published GRE endpoint and routes internet-bound prefixes into it. A route-based IPsec tunnel to an AWS virtual private gateway ignores both the destination and the guide: that path enters a VPC, not the secure internet gateway. An OSPF adjacency with the gateway across the campus LAN does not cross the internet to reach it and is not how this SIG is attached. A policy-based crypto map matching only the router’s management host would leave user internet traffic outside the security association; moreover, the guide calls for plain GRE, not IPsec. Exam caveat: another SIG product may require IPsec or GRE inside IPsec. The guide for this gateway is the source of truth, and a template copied from an AWS VPN will not meet it. Operational check: confirm the tunnel interface is up to the SIG GRE endpoint, a user trace exits through that tunnel, and the SIG portal reports the GRE tunnel healthy.