A company requires encryption from its data center router to AWS VPN termination. A supported Direct Connect circuit offers MACsec. Why might the design still require an IPsec VPN?

1. MACsec protects the supported Ethernet link, while IPsec supplies the required tunnel protection.
2. IPsec can only run over the public internet and never over Direct Connect.
3. MACsec provides application-layer authorization for all AWS API requests.
4. Direct Connect encrypts all traffic end to end without either MACsec or IPsec.