Which of the following is NOT true about IPSec Tunnel mode?

A.
Fundamentally an IP tunnel with encryption and authentication

B.
Works at the Transport layer of the OSI model

C.
Have two sets of IP headers

D.
Established for gateway service

Explanation:
IPSec Tunnel mode works at the Internet layer, not at the Transport layer.
Incorrect Answers:
A: In IPSec tunnel mode, the entire IP packet is encrypted and/or authenticated.
C: In tunnel mode, the entire IP packet is encrypted and/or authenticated. It is then encapsulated into a new IP
packet with a new IP header. That is, in tunnel mode, there are two sets of IP headers.
D: Tunnel mode is used to create virtual private networks for network-to-network communications (e.g.
between routers to link sites), host-to-network communications (e.g. remote user access or for gateway
services) and host-to-host communications.

https://en.wikipedia.org/wiki/IPsec#Tunnel_mode