Which IPsec encryption mode is appropriate when the destination of a packet differs from the security termination point?

Transport mode encrypts only the payload of the original IP packet, leaving the original IP header intact, meaning the security termination points are typically the end hosts themselves, not a separate gateway.

Main mode is an Internet Key Exchange (IKE) Phase 1 exchange mode used for establishing security associations, not an encryption mode for data packets.

Aggressive mode is an Internet Key Exchange (IKE) Phase 1 exchange mode, similar to main mode but faster, used for establishing security associations, not an encryption mode for data packets.

IPsec tunnel mode encapsulates the entire original IP packet, including its header and payload, within a new IP packet with a new header. This allows security gateways to act as the security termination points, decrypting the traffic before forwarding the original packet to its final destination, thus separating the security endpoint from the data's ultimate destination.