In IPSec, if the communication is to be gateway-to-gateway or host-to-gateway:

A.
Tunnel mode of operation is required

B.
Only transport mode can be used

C.
Encapsulating Security Payload (ESP) authentication must be used

D.
Both tunnel and transport mode can be used

Explanation:
In IPSec tunnel mode, the entire IP packet is encrypted and/or authenticated. It is then encapsulated into a new
IP packet with a new IP header. Tunnel mode is used to create virtual private networks for network-to-network
communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access)
and host-to-host communications.
Incorrect Answers:
B: Tunnel mode, not transport mode, must be used.
C: Tunnel mode, not ESP authentication, must be used.
D: Only tunnel mode can be used.

https://en.wikipedia.org/wiki/IPsec#Tunnel_mode