As an AWS Solutions Architect, you are helping the team to set up an AWS Site-to-Site VPN so that the AWS resources in a VPC can communicate with one remote site. You plan to use IPSec VPN tunnels in the VPN connections as they provide secure connections with redundancy. When creating the Site-to-Site VPN connection in AWS console, which of the following options can you configure for the VPN tunnels?

Answer options:

A.The number of VPN tunnels.
B.The encryption algorithms used by the VPN tunnels.
C.The memory used by the VPN tunnels.
D.The TCP ports allowed by the VPN tunnels.

Correct Answer: B
Option A is incorrect because AWS Site-to-Site VPN has two tunnels for redundancy and users cannot modify this setting.
Option B is CORRECT because the encryption algorithms of VPN IPSec tunnels can be configured by users such as AES128 and AES256. Please check the following screenshot when configuring the VPN tunnels:
AWS Site-to-Site VPN provides two tunnels for redundancy shown by the following snapshot:
When one tunnel becomes unavailable, network traffic is automatically routed to the other available tunnel.
Option C is incorrect because users cannot configure memories used by VPN tunnels.
Option D is incorrect because when creating a VPN tunnel, users cannot allow or block any TCP ports.
References:
https://docs.aws.amazon.com/vpn/latest/s2svpn/how_it_works.html
https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html
https://docs.aws.amazon.com/vpn/latest/s2svpn/VPNTunnels.html