During post-deployment, a customer's network team asks whether Data Domain-to-Data Domain replication across a WAN link needs a site-to-site VPN solely to protect replication payload confidentiality. What should you recommend?

Data Domain replication is a protected appliance-to-appliance data movement service. Replication contexts are always authenticated with a shared secret, and encryption of the replication stream in flight is an option enabled per context; once it is on, the source and target DD systems protect the payload themselves, so it is not exposed merely because the link crosses a WAN. A site-to-site VPN can still be appropriate where policy requires private addressing, routing isolation, or a controlled boundary, but it is not the only control for replication payload confidentiality. A response that claims replication traffic cannot be encrypted misunderstands the data security model: with the option enabled, the appliance pair, not the network tunnel, protects the replicated payload in transit. A response that limits encryption to DD Boost is incorrect because DD Boost protects backup client-to-appliance traffic, while replication is a separate appliance-to-appliance mechanism. A response that says DD Boost or an MTree setting controls replication encryption is wrong: MTree functions don't enable a transport tunnel for replication, and DD Boost isn't the replication engine. Exam caveat: distinguish data-in-transit protection from network segmentation and access control. Operational check: verify that encryption is enabled on the replication context (it is not on by default) and confirm the VPN requirement is documented as segmentation rather than payload security.