An administrator values transport security strength above network speed when implementing an SSL VPN. Which of the following encryption ciphers would BEST meet their needs?

SHA256 is a cryptographic hash function used for integrity verification, not a symmetric encryption cipher used to protect data in transit.

RC4 is a deprecated stream cipher with well-documented vulnerabilities and is explicitly prohibited in modern TLS configurations.

3DES applies DES encryption three times and is considered weak by modern standards, with NIST deprecating it due to its small 64-bit block size and susceptibility to Sweet32 attacks.

AES (Advanced Encryption Standard) with a 128-bit key is a modern, symmetric block cipher standardized by NIST and considered cryptographically strong. Compared to the other cipher options listed, AES128 offers the best security-to-performance balance while being far more secure than RC4 or 3DES for VPN transport encryption.