Parks HQ needs an IP overlay to a remote nature center across an untrusted ISP and staff propose a plain GRE tunnel. What limitation should they recognize?
Select an answer to reveal the explanation.
Short Explanation
GRE is like wrapping a letter in a clear plastic sleeve so it can ride someone else's mail truck—it travels as a neat package, but anyone holding the sleeve can still read the letter. On an untrusted ISP, you still need crypto (often IPsec) if the contents must stay private.
Full Explanation
Parks HQ proposing a plain GRE tunnel to a remote nature center across an untrusted ISP must recognize what GRE does and does not provide. GRE encapsulates private IP traffic so an overlay can traverse an intervening network, which is useful for parks site-to-site reachability. Classic GRE alone does not encrypt or integrity-protect the tunneled payload; confidentiality typically requires IPsec or another crypto layer when the underlay is an untrusted ISP path to the nature center. GRE does not always encrypt payloads with AES and never need additional security—that invents crypto properties GRE does not have. GRE is not limited to non-IP protocols and unable to transport IP overlays; carrying IP is a primary GRE use case. GRE also does not replace the underlay ISP with a private MPLS circuit automatically; the ISP underlay remains, and GRE only wraps overlay packets for transit. Exam caveat: GRE-over-IPsec or IPsec protecting GRE is a common pattern, but GRE by itself remains cleartext encapsulation—do not treat tunnel-up as equivalent to secure. Operational check: capture or inspect parks GRE traffic on the ISP path and confirm payloads are readable without crypto; then add IPsec, re-verify confidentiality, and confirm the nature-center overlay still forwards after the crypto layer is applied.