* A (Posture assessment with remediation VLAN):Posture assessment checks endpoint compliance (such as AV definitions). Non-compliant devices are placed into a remediation VLAN where they can update before regaining normal network access.
Other options explained:
* B: SGTs provide segmentation but are not posture-specific.
* C: dACLs with SGTs handle policy enforcement, but posture control is required for AV compliance.
* D: Quarantine VLAN isolates devices but doesn't automate remediation.

* C (Significant effort and time): In a Waterfall model, changes introduced after the design phase require rework of multiple design documents, validations, and downstream impacts on implementation and testing. This leads to significant delays and resource consumption compared to more flexible models like Agile.
Other options explained:
* A: Creativity is not the primary impact.
* B: Rework is true but doesn't fully capture the scope of additional effort.
* D: Waterfall does not provide inherent flexibility to absorb late changes.
-

# Explanation:
* A: IPsec point-to-point tunnels provide immediate, well-supported encryption across both MPLS and P2P transports. Quick to implement and doesn't rely on service provider support.
Other options:
* B: GETVPN requires coordination and is more complex to deploy.
* C: Central firewalls don't encrypt traffic over the WAN.
* D: VRF-Lite with IPsec is viable but more complex than direct IPsec tunnels.