Which statement about the fragmentation of IPsec packets in routers is true?

A.
By default if the packet size exceeds MTU of ingress physical interface, it will be
fragmented and sent without encryption.

B.
By default if the packet size exceeds MTU of the egress physical interface, it will be
dropped.

C.
By default, the router knows the IPsec overhead to add to the packet, performs a
lookup if the packet will exceed egress physical interface IP MTU after encryption, then
fragments the packet before encrypting and separately encrypts the resulting IP
fragments.

D.
By default, the IP packets that need encryption are first encrypted with ESP, if the
resulting encrypted packet exceeds the IP MTU on the egress physical interface, then
the encrypted packet is fragmented before being sent.