Which statement about IPsec modes is correct when implementing an IPsec VPN?

In IPsec tunnel mode, the entire original IP packet (header and payload) is encrypted and then encapsulated with a new IP header. This provides the highest level of security as the original source and destination IP addresses are hidden. IPsec transport mode encrypts only the IP payload, leaving the original IP header intact. This means the original source and destination IP addresses are visible, which is less secure than tunnel mode but can be useful for host-to-host communication or when another tunneling protocol (like GRE) is already providing encapsulation. IPsec transport mode does not inherently increase GRE tunnel security over tunnel mode; in fact, tunnel mode generally offers stronger encapsulation. IPsec transport mode encrypts the Layer 4 header along with the payload, not leaving it unencrypted.