You are designing the QoS features for a large enterprise network that includes DMVPN. When would you need to configure QoS preclassify?

Marking packets with DSCP bits is a QoS action applied by a policy-map and does not require preclassify; preclassify is about reading pre-tunnel packet headers for classification, not marking.

Marking packets with ToS bits is a QoS marking action, not a scenario that requires preclassify, which addresses classification of original headers before encapsulation.

If the service provider requires DSCP bits to be set, that is handled by a DSCP marking policy applied to the outbound interface, not by QoS preclassify.

When a QoS policy on a DMVPN tunnel interface must classify packets based on ACL matches, source/destination IP addresses, or port numbers from the original inner packet, those fields are hidden once the packet is GRE-encapsulated and IPsec-encrypted. The 'qos pre-classify' command instructs the router to copy the inner packet header information before encapsulation so the QoS policy can still reference the original packet attributes for classification and queuing decisions.