An enterprise needs to support many remote networks behind a single tunnel endpoint and wants to add or change remote subnets without reconfiguring crypto ACLs. Which VPN design best satisfies this requirement?

Route-based IPsec, such as FlexVPN, is the best solution because it uses tunnel interfaces (e.g., VTI or GRE over IPsec) which encapsulate all traffic routed into them. This eliminates the need for crypto ACLs to define interesting traffic, allowing new subnets to be added or removed simply by updating routing tables without reconfiguring the IPsec tunnel itself. Policy-based IPsec requires manual updates to crypto ACLs for every subnet change, making it inflexible. GRE without IPsec provides no encryption, failing security requirements. Static GRE tunnels for each remote subnet would be cumbersome to manage and scale, especially if encryption is also needed.