CCNP Practice Question: Which three statements about SSL VPNs are true?…

Which three statements about SSL VPNs are true? (Choose three.)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

SSL VPNs use the TLS protocol to encrypt traffic between client and server.

SSL VPNs use TLS for encryption, can provide clientless access via web browser, and support port forwarding for legacy applications. They do not require IPsec and can use any port (typically 443).

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
SSL VPNs use the TLS protocol to encrypt traffic between client and server.
Why this is correct
Correct because SSL VPNs are based on TLS (formerly SSL).
✗
SSL VPNs require a pre-shared key for authentication.
Why it's wrong here
Incorrect because SSL VPNs typically use certificates or username/password, not PSK.
✓
Clientless SSL VPN access allows users to access web applications using only a browser.
Why this is correct
Correct because clientless mode uses a web portal without additional software.
✗
SSL VPNs can only operate over TCP port 443.
Why it's wrong here
Incorrect because SSL VPNs can use other ports, though 443 is common.
✓
SSL VPNs support port forwarding for non-web applications.
Why this is correct
Correct because port forwarding allows TCP-based applications to tunnel through the SSL VPN.

Quick reference

VPN Protocol Comparison

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

About these practice questions

Courseiva writes every 350-401 question from scratch — 1,175 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Ready to practise?

Start a scored session and see where you stand.

Start practice session

Timed practice sets

Short scored sets — answer, get feedback, read the explanation, move on.

CCNP Practice Questions 2 — 50 Questions→Free CCNP Practice Test 2 — 30 Questions→

Domain-focused practice

Drill one exam section at a time instead of jumping between unrelated topics.

Virtualization Architecture Automation

Practice by scenario

Pick a question style — troubleshooting, exhibit-based, PBQ, or configuration.

Browse scenarios

Go deeper on a topic

One concept per page — questions, worked explanations, and a short concept guide.

Security practice questions Network Assurance practice questions ENCOR ACLs and CoPP practice questions

Keep going

350-401 practice test All 350-401 questions All Cisco practice questions

This 350-401 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 350-401 exam.