An administrator configures two VPN tunnels to provide for failover and uninterrupted VPN service. What should an administrator configure to enable automatic failover to the backup tunnel?

Replay Protection is an IPsec security feature that prevents an attacker from intercepting and retransmitting authenticated packets, not for failover.

Zone Protection profiles protect against flood attacks and other packet-based threats to zones, unrelated to VPN tunnel failover.

Tunnel Monitor (or Dead Peer Detection in IPsec) is configured to actively check the operational status of a VPN tunnel by sending keepalive probes. If the primary tunnel fails to respond to these probes, the firewall can automatically re-route traffic to a pre-configured backup tunnel, ensuring continuous VPN connectivity and failover.

Passive Mode relates to high availability configurations where one device is idle, not a specific mechanism for VPN tunnel failover between two distinct tunnels.