A VPN connection has two tunnels. Only one is configured on the customer gateway, and a maintenance event interrupts traffic. What is the appropriate implementation change?

1. Configure both tunnels and validate customer routing failover between them.
2. Replace BGP with a public S3 bucket policy.
3. Put both tunnel outside addresses into one DNS A record as the VPN configuration.
4. Keep one tunnel and extend application retry indefinitely.