A company is opening a branch office and needs all traffic between the branch network and headquarters to travel over the internet encrypted, without installing client software on each branch workstation. Which solution BEST meets this requirement?

A site-to-site VPN connects two networks through gateways at each location, typically using IPsec in tunnel mode to encrypt and authenticate all traffic that crosses the internet between them. Workstations send traffic normally, and the gateways handle encryption transparently, which satisfies the requirement that no client software be installed on branch computers while protecting all inter-site traffic. A remote access VPN client on each computer contradicts the stated requirement and is designed for individual users connecting from varied locations rather than for linking two fixed networks. A GRE tunnel encapsulates traffic so it can traverse another network and is often used to carry routing protocols, but GRE by itself provides no encryption or authentication, so the traffic would cross the internet readable to anyone on the path; it must be combined with IPsec to be protected. A TLS web portal offers clientless access to specific web applications, but it covers only those applications rather than all traffic between the networks. Exam caveat: tunneling and encryption are separate properties, and exam items often test whether a tunneling protocol actually protects confidentiality. Operational check: confirm the tunnel negotiates strong encryption and authentication settings, verify that branch-to-headquarters subnets route through the tunnel, and monitor the tunnel's status for unexpected drops.