How are outbound signals from the ZIA connector/app sent to the node?

My understanding is that ZIA has 3 ways to do a connection to the ZScaler node. One is through the connector/app, another is through an IPSec VPN tunnel and the third is through a GRE tunnel.

However, I have come across someone saying that outbound connections from the connector/app are actually sent via GRE. Can someone confirm or correct that please?

And if that is true, how is the data secured when in transit?

Thank you!