Which configuration limits TCP segment size on a DMVPN IPsec tunnel to avoid MTU issues and improve application performance?

The correct option uses ip tcp adjust-mss to limit the TCP Maximum Segment Size (MSS) for packets traversing the tunnel. This is crucial for DMVPN IPsec tunnels because the IPsec encapsulation adds overhead, reducing the effective MTU. If the TCP MSS is not adjusted, large TCP segments sent by applications may exceed the tunnel's MTU, leading to fragmentation or packet drops, which negatively impacts performance. ip tcp adjust-mss ensures that the TCP sender advertises a smaller MSS, preventing the need for fragmentation within the tunnel. The crypto ipsec fragmentation after-encryption command is also important as it allows the router to fragment packets after IPsec encryption, which is generally preferred for performance and security in DMVPN scenarios. Incorrect options: ip tcp payload-size and ip tcp max-segment are not valid Cisco IOS commands for adjusting TCP MSS. ip tcp packet-size is also not a valid command for this purpose. crypto ipsec fragmentation before-encryption would fragment the original packet before encryption, potentially exposing information about the original packet structure and increasing processing overhead.