A network administrator needs to establish a tunnel that can:• Authenticate packet headers.

The best answer is A. IPSec. The question describes a complete secure tunneling solution that can authenticate traffic, support encrypted payload delivery, and use key exchange mechanisms. IPSec is the suite of protocols designed for exactly that purpose. It can use AH for header authentication, ESP for payload encryption, and key exchange methods such as IKE to negotiate security associations and encryption keys.

The reason the other options are not correct is that they only represent parts of the larger solution or do not provide security by themselves. ESP handles encryption and can also provide integrity features, but it is not the full framework for secure tunneling on its own. AH provides authentication and integrity for packet headers, but it does not encrypt the payload. GRE creates tunnels but does not provide native encryption or strong authentication by itself.

For Network+ study purposes, when a question combines authentication, encryption, and secure key exchange in one scenario, the broader technology being tested is IPSec. It is widely used for site-to-site VPNs and remote-access VPNs because it provides confidentiality, integrity, and secure tunnel establishment. That makes A the correct answer.