Select ALL requirements for a working site-to-site Virtual Private Network (VPN) carrying traffic between private networks.

### Why this is right\n- **Compatible peer and cryptographic settings** allow the gateways to authenticate and negotiate protection.\n- **A route to the remote local network through the tunnel** directs packets into the VPN.\n- **Security policies permitting the required traffic** authorize forwarding between the relevant zones.\n\n### The concept\nA VPN is one component of connectivity. Host addressing, peer reachability, tunnel negotiation, routing, and firewall policy must align. A working control connection does not prove that the traffic-protecting association is established or that application packets have a valid route and permission.\n\n### The other options\n- **An established IKE Security Association (SA) with no need to check IPsec or routing**: IKE status alone does not establish end-to-end data forwarding.\n\n### Terms\n- **IKE**: Internet Key Exchange, the protocol that negotiates VPN peer relationships.\n- **SA**: Security Association, negotiated parameters for protected communication.\n\n### Remember\nVerify the control plane, data plane, routes, and permissions separately.