Choose two. An engineer must apply QoS to application flows that traverse an IPsec tunnel. Which two approaches are valid to ensure correct classification and treatment?

When applying QoS to traffic traversing an IPsec tunnel, classification must occur when the original, unencrypted packet headers are visible. The first correct option, "Classify and mark flows on the tunnel endpoint before IPsec encryption," is valid because the router originating the IPsec tunnel has access to the cleartext inner headers before encryption. This allows for accurate classification and marking (e.g., DSCP) of the original application flows. The second correct option, "Classify and apply QoS after IPsec decryption on the tunnel endpoint that terminates the tunnel," is also valid because the terminating router decrypts the IPsec tunnel, making the original inner headers visible again for classification and QoS treatment. The incorrect option, "Classify the inner headers on intermediate routers that only see the encrypted tunnel payload without decryption," is invalid because intermediate routers only see the outer IPsec headers and cannot classify based on the inner application-specific headers, as the payload is encrypted. Similarly, "Rely on VLAN CoS values on core switches to identify inner application flows without terminating the tunnel" is incorrect because VLAN CoS is a Layer 2 mechanism and is not directly visible or applicable to identifying inner Layer 3/4 application flows within an encrypted IPsec tunnel payload on core switches.