Refer to the exhibit. Which two options are two characteristics of the single-tier headend architecture for DMVPN designs? (Choose two.)

In a single-tier headend, the same physical router handles both mGRE tunnel termination and IPsec crypto processing, unlike dual-tier designs that offload crypto to a separate device.

Having two different headend routers per DMVPN cloud describes a dual-hub or redundant headend design, which is a characteristic of multi-tier architecture, not single-tier.

Single-tier headend designs are deployed in dual-cloud topologies where each spoke connects to two separate DMVPN clouds, providing redundancy and enabling spoke-to-spoke communication across clouds via NHRP.

DMVPN inherently supports spoke-to-spoke connectivity via NHRP dynamic resolution regardless of headend tier; single-tier does not restrict the design to hub-and-spoke only.

Spokes can be configured as Rendezvous Points in DMVPN multicast deployments; this is not an architectural restriction specific to single-tier headend designs.