Which statement is true about an IPsec/GRE tunnel?

A.
The GRE tunnel source and destination addresses are specified within the IPsec transform set.

B.
An IPsec/GRE tunnel must use IPsec tunnel mode.

C.
GRE encapsulation occurs before the IPsec encryption process.

D.
Crypto map ACL is not needed to match which traffic will be protected.

Explanation:
http://www.cisco.com/en/US/ts/fn/620/fn62394.html