Encapsulation
The wrapping of data from a higher network layer inside the header, and sometimes trailer, of the layer below as it moves down the stack; decapsulation removes them on arrival.
Encapsulation is how layered network models move data. As a message passes down the OSI model or the TCP/IP model, each layer treats what it receives as its payload and adds its own control information. The transport layer forms a segment (or a datagram for UDP), the network layer wraps that in an IP header to form a packet, and the data link layer adds a header and a trailer to form a frame, which the physical layer sends as bits. Each is a protocol data unit. Decapsulation reverses this at the receiver, each layer removing its own header.
The same idea underlies tunnelling. A VPN or an overlay such as VXLAN places a whole packet or frame inside another so it can cross a network it could not cross on its own. Encapsulation separates traffic but gives no confidentiality by itself; that depends on whether the tunnel protocol also encrypts. Software engineering uses the same word for a different idea, bundling data with the methods that act on it, which is a Domain 8 concept.
Exam relevance: questions in this area tend to turn on the order of the units (segment, packet, frame, bits) and on which layer adds which header. Candidates are also expected to know that a tunnel is not automatically encrypted.