Multicast routing updates must cross an IP network between two data halls. Encryption will be added as a separate IPsec layer, and the encapsulation itself must not encrypt. Which encapsulation fits?
Select an answer to reveal the explanation.
Short Explanation
You need a plain envelope that can carry a letter across town, with the lock added as a separate pouch. GRE encapsulates the multicast routing updates so they can cross the IP network, and it does not encrypt them. Encryption stays in the IPsec layer, so a protocol built to encrypt, tunnel mode that is that encryption, or an Ethernet overlay is not the envelope.
Full Explanation
Generic Routing Encapsulation wraps packets, including multicast routing updates, inside a new IP packet so they can cross a network that forwards ordinary IP. GRE itself does not encrypt. That matches the data halls: the encapsulation carries the updates, and IPsec is a separate layer. Encapsulating Security Payload is the IPsec protocol that encrypts. It can protect a GRE tunnel, and the stem says the encapsulation itself must not encrypt. IPsec tunnel mode is the tempting twin because it also carries packets across an IP network. It is the encryption layer the design kept separate. VXLAN encapsulates Ethernet frames for a stretched layer-2 segment. It is not the tunnel these routing updates are asking for. Exam caveat: GRE carries the updates only if the routers send them into the tunnel. The encapsulation does not by itself turn on a routing protocol. Operational check: confirm the tunnel is up, that the updates are encapsulated in GRE, and that any encryption sits on the IPsec layer rather than inside GRE.