The convention center DMZ must protect partner connectivity across the Internet at ENCOR depth. What is the primary purpose of IPsec tunneling in that scenario?
Select an answer to reveal the explanation.
Short Explanation
Partners on the Internet are on the public highway. IPsec tunneling is the armored truck—confidential and integrity-checked—so DMZ partner traffic is not riding in an open pickup bed across that untrusted path.
Full Explanation
The convention center DMZ protecting partner connectivity across the Internet at ENCOR depth uses IPsec tunneling primarily to provide confidential, integrity-protected transport for site or partner traffic over untrusted paths. Partners connecting across the public Internet need cryptographic protection of payloads and integrity checks; IPsec tunneling is the data-path virtualization tool that meets that purpose without trusting the Internet as a private wire. IPsec tunneling does not replace OSPF with RIP inside every VRF automatically—IGP choice inside VRFs is unrelated to the crypto transport purpose. IPsec is not used only to negotiate EtherChannel load-balance hashes between partners; EtherChannel hashing is a local link-aggregation concern. IPsec also does not convert partner VLANs into Type 2 hypervisors on the edge; that mixes Layer 2 segmentation with virtualization platform myths. Exam caveat: confidentiality and integrity apply to traffic covered by the IPsec policy—traffic outside interesting-traffic definitions still rides cleartext, so incomplete selectors leave partner flows exposed. Operational check: define partner interesting traffic, establish IPsec to the convention-center DMZ peer, confirm SAs and encrypted packet counters, and validate partner applications while ensuring unencrypted captures on the Internet path no longer show clear payloads for protected flows.