CAPWAP and DTLS are the type of standards-based encryption used by office extension APs for the traffic tunnel. Office extension APs are wireless access points that can be deployed in remote locations and connect to a central wireless controller via a secure tunnel over the Internet. CAPWAP is the Control and Provisioning of Wireless Access Points protocol, which defines how the wireless controller and the office extension APs communicate and exchange control and data messages. DTLS is the Datagram Transport Layer Security protocol, which provides encryption and authentication for the CAPWAP tunnel. DTLS is based on TLS, but it uses UDP instead of TCP as the transport layer protocol, which makes it more suitable for real-time applications. DTLS protects the CAPWAP tunnel from eavesdropping, tampering, and replay attacks, and ensures the confidentiality and integrity of the wireless traffic. References: CWNP, CWDP Certified Wireless Design Professional Official Study Guide, Configure OEAP and RLAN on Catalyst 9800 WLC, Hardening Microsoft 365, Office 2021, Office 2019 and Office 2016