next-hop service set

Which statement is true about next-hop-style and interface-style service sets for IPSec VPNs?