CCNP Security Practice Question
A network administrator is configuring a Cisco IOS router to act as a VPN headend for remote access using SSL VPN. The requirement is to allow users to connect via a web browser and access internal web applications without installing a client. Which feature should the administrator configure?
⚠ Common exam trap
It's easy for candidates to confuse the router's HTTP management server with the WebVPN feature, or assuming IPsec can provide clientless access.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure 'webvpn' with 'enable' and set up a context with a gateway and a port-forward or URL list.
Clientless SSL VPN on Cisco IOS is configured using the 'webvpn' feature. Enabling 'webvpn' and creating a context with a gateway, along with URL lists or port-forwarding, allows users to access internal web applications through a browser without a client. Other options either require a client or do not provide VPN functionality.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure 'ip http server' and 'ip http secure-server' to allow web access to internal applications.
Why it's wrong here
Enabling the HTTP server on the router provides access to the router's own web management interface, not to internal web applications. It does not create a VPN tunnel or authenticate remote users. This would expose the router's GUI and does not satisfy the requirement for clientless SSL VPN access to internal resources.
- ✓
Configure 'webvpn' with 'enable' and set up a context with a gateway and a port-forward or URL list.
Why this is correct
Cisco SSL VPN (WebVPN) allows clientless access through a browser. Enabling 'webvpn' and configuring a context with a gateway provides the entry point, while URL lists or port-forwarding define accessible resources. This meets the requirement for browser-based access without a client. It is the standard configuration for clientless SSL VPN on Cisco IOS.
- ✗
Configure 'crypto ssl server' and 'crypto ssl client' policies for the SSL VPN.
Why it's wrong here
The 'crypto ssl' commands are used for SSL/TLS proxy or AnyConnect SSL VPN configurations, but clientless WebVPN is configured under 'webvpn'. The 'crypto ssl' commands alone do not provide the clientless portal. They are typically used with AnyConnect, which requires a client. This does not meet the requirement for browser-based access without a client.
- ✗
Configure 'crypto isakmp policy' and 'crypto ipsec transform-set' for remote access.
Why it's wrong here
IKEv1 and IPsec transform sets are used for IPsec VPNs, which require a VPN client or a site-to-site peer. They do not provide clientless browser-based access. While IPsec can be used for remote access, it requires client software, which contradicts the requirement. This configuration would not enable web browser access to internal applications.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
About these practice questions
Courseiva writes every 350-401 question from scratch — 1,923 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.