In a Versa Secure SD-WAN deployment, by default, all data traffic is forwarded on IPSec tunnels, ensuring that the data traffic is encrypted for security purposes. Similarly, all control traffic is also forwarded on IPSec tunnels by default, as it is crucial to maintain the security and integrity of control information in the network. Therefore, the correct statements are that both data and control traffic are forwarded on IPSec tunnels by default.