A security engineer wants to implement a site-to-site VPN that will require SSL certificates for mutual authentication. Which of the following should the engineer implement if the design requires…

Tunnel mode IPSec operates at Layer 3, encrypting and encapsulating entire IP packets, and therefore does not propagate Layer 2 MAC addresses across the tunnel directly.

Transport mode IPSec also operates at Layer 3, encrypting only the payload of an IP packet, and does not provide Layer 2 connectivity for MAC address visibility across a tunnel.

While L2TP is a Layer 2 tunneling protocol capable of carrying MAC addresses, it does not natively use SSL certificates for its authentication and typically relies on IPSec for robust security, which uses X.509 certificates or pre-shared keys, not specifically SSL certificates for the tunnel authentication.

SSL VPNs natively utilize SSL/TLS certificates for robust mutual authentication, directly fulfilling a primary requirement. Many advanced SSL VPN client solutions can establish a virtual Layer 2 connection (e.g., using a TAP adapter), which enables the transmission of Layer 2 frames and thus allows client MAC addresses to be visible across the tunnel.