Which of the following descriptions about GRE over IPSec is incorrect?

Which of the following descriptions about GRE over IPSec is incorrect?
A . The IP header added during the IPSec encapsulation process, that is, the source address is the interface address of the IPSec gateway to which the IPSec security policy is applied, and the destination address is the interface address of the IPSec peer to which the IPsec security policy is applied.
B . When gateways use GRE over IPSec to connect, GRE encapsulation is performed first, and then IPSec encapsulation is performed.
C . The IP header added during the GRE encapsulation process, that is, the source address is the source address of the IPSec tunnel, and the destination address is the destination address of the IPSec tunnel.
D . The data flow that IPSec needs to protect is the data flow from the GRE starting point to the GRE ending point.

Answer: C