An established Internet Key Exchange (IKE) Security Association (SA) proves that application traffic can pass between the sites.

### Why this is right\nAn IKE SA indicates that control-plane negotiation has established a protected relationship between peers. Application traffic also depends on IPsec traffic protection, routes, policies, host settings, and return paths.\n\n### The concept\nIKE handles peer authentication and negotiation. Child Security Associations protect user traffic, but even an established IPsec tunnel does not automatically create routes or authorize traffic through security policy. A tunnel status indicator is useful evidence, not proof of end-to-end application connectivity.\n\n### The other options\n- **True**: this assumes negotiation alone configures forwarding and access, which it does not.\n\n### Terms\n- **IKE**: Internet Key Exchange, which authenticates VPN peers and negotiates keys and settings.\n- **SA**: Security Association, negotiated security information used to protect communications.\n\n### Remember\nTunnel negotiation is necessary, but routes and policies still determine whether data passes.