Which two mechanisms ensure data‑plane packet integrity in the Cisco SD‑WAN architecture? (Choose two.)

Authentication Headers (AH) and Encapsulation Security Payload (ESP) are both integral parts of IPsec, which is used in Cisco SD-WAN to secure data plane traffic. AH provides data integrity, data origin authentication, and an optional anti-replay service by hashing the entire IP packet (except mutable fields) and adding the hash to the header. ESP provides confidentiality (encryption), data origin authentication, connectionless integrity, and an anti-replay service. While AH ensures integrity by detecting unauthorized modifications, ESP provides a more comprehensive security suite by encrypting the data as well. Certificates are used for control plane authentication and key exchange, not directly for data plane packet integrity. Transport locations refer to the physical or logical interfaces used for transport. A TPM chip provides hardware-based security for keys and boot processes, but not direct packet integrity.