An administrator has configured a route-based site-to-site IPsec VPN. Which statement is correct regarding this IPsec VPN configuration?

Firewall policies for IPsec VPNs, like other policies, are evaluated in order, but there's no requirement for them to be at the top of the list; their placement depends on the overall policy hierarchy.

Route-based VPNs are highly suitable for hub-and-spoke topologies because they allow for routing protocols to exchange routes over the VPN tunnels, simplifying network management.

In route-based IPsec VPNs, routes to remote subnets are not automatically created based on quick mode (Phase 2) selectors; instead, static routes or dynamic routing protocols must be manually configured to direct traffic through the virtual IPsec interface.

In a route-based IPsec VPN configuration on FortiGate, completing the Phase 1 configuration automatically creates a virtual IPsec tunnel interface, which serves as the logical endpoint for the VPN and is used for routing and firewall policies.