Ridgefield needs encrypted hybrid connectivity over the internet and resilience to a supported single-path failure. Which design should it evaluate?

1. Public Cloud NAT as a substitute for the hybrid encrypted tunnel.
2. HA VPN with the documented redundant tunnels, interfaces, and dynamic routing.
3. One VPN tunnel renamed as redundant.
4. A plain VLAN attachment assumed to imply IPsec encryption.