IPSec VPN confusion with layer 2 and/or layer 3 (OSI model)

Hello,

I was checking out the slides for Cloud Infrastructure Planning and Design Course.

In module 7, it said IPSec can connect two segments using layer 2 protocols.

(and in one of the question of practice test, there is a question that refers to 'linking layer-2 network segments').

I think it should need more explanation on how it could be done using 'layer 2 protocols'.

Case 1:

If IPSec is used as site-to-site VPN, I Personally think IPSec is working / linking two sites in layer 3.

Case 2:

IPSec over MPLS

To my understanding MPLS is an routing protocol and IPSec would working in layer 3 for the encryption.

Case 3:
As I know there is L2TP+IPSec VPN, which L2TP work as an layer 2 tunneling protocol.

I suppose IPSec still work in layer 3 in this case?