A Virtual Private Network (VPN) requires how many Security Associations?

In Internet Protocol Security (IPsec) virtual private network architecture, a Security Association (SA) establishes a unidirectional simplex logical connection specifying security parameters such as encryption algorithms, authentication mechanisms, and cryptographic keys. Because an individual SA only provides security services for traffic flowing in one direction, a full IPsec VPN tunnel requires a minimum of two Security Associations to enable bidirectional secure communication between two peers: one SA for outbound traffic transmission and a second SA for inbound traffic reception. This dual-SA structure ensures that both communication paths independently maintain cryptographic negotiation, sequence numbering, and security parameter indices across operational technology and enterprise VPN gateways.

A. 5: Five SAs exceed the fundamental requirement for a standard bidirectional IPsec connection, which operates using two unidirectional SAs.
B. 4: Four SAs are unnecessary for a standard single-protocol IPsec tunnel, as unidirectional channel pairing requires only two SAs.
C. 3: Three SAs represents an odd count incompatible with symmetrical unidirectional pairing needed for bidirectional IPsec traffic flow.

IETF RFC 4301, Security Architecture for the Internet Protocol, Section 4.1 (Security Association Definition), pp. 16–19. https://doi.org/10.17487/RFC4301

NIST SP 800-77 Rev. 1, Guide to IPsec VPNs, Section 3.1 (IPsec Fundamentals and Security Associations), pp. 3-1 – 3-4.