A housing authority needs site-to-site confidentiality for ordinary IP unicast between two offices and does not require GRE's multiprotocol overlay. Which approach fits?
Select an answer to reveal the explanation.
Short Explanation
If all you need is a locked courier for normal IP traffic, you do not have to wrap the box in GRE plastic first. IPsec can protect that site-to-site IP unicast on its own—save GRE for when you truly need its overlay encapsulation tricks.
Full Explanation
A housing authority that needs site-to-site confidentiality for ordinary IP unicast between two offices and does not require GRE's multiprotocol overlay should use IPsec tunneling (or IPsec-protected transport) to encrypt that IP unicast without introducing GRE solely for encapsulation. IPsec directly meets the confidentiality requirement for IP traffic; GRE is optional when you need GRE-specific overlay behaviors, not mandatory merely to turn encryption on between the housing offices. Always forcing GRE under IPsec even when only IP unicast encryption is required adds unnecessary overlay complexity and fails the stem's constraint. Disabling encryption and stretching a single cleartext VLAN between offices abandons confidentiality and expands Layer 2 risk across sites. Replacing IPsec with LISP map-server authentication alone for payload confidentiality confuses mapping/control-plane authentication with cryptographic protection of user payloads. Exam caveat: IPsec without GRE is appropriate for IP unicast confidentiality, but if the authority later needs non-IP or complex overlay encapsulation, GRE (or another overlay) may still be justified—choose based on requirements, not habit. Operational check: define interesting traffic as the office-to-office IP unicast, establish IPsec without a GRE tunnel, confirm SAs and encrypted counters, and verify applications work while a capture on the WAN shows protected payloads.