300-410 VPN Technologies Practice Question
A network administrator is troubleshooting an IPsec VPN between two Cisco routers. The VPN tunnel is up, but only small pings succeed; larger packets fail. The administrator suspects an MTU or fragmentation issue. Which action is most likely to resolve the problem while maintaining security?
⚠ Common exam trap
The trap here is assuming that enabling PMTUD alone will fix the issue, but ICMP filtering often breaks PMTUD, making manual MTU and MSS adjustments necessary.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Adjust the tunnel interface MTU and TCP MSS clamping on the tunnel interface.
IPsec and GRE encapsulation add overhead, reducing the effective MTU. When large packets are sent, they may exceed the path MTU and get dropped if fragmentation is not allowed. Adjusting the tunnel interface MTU and configuring TCP MSS clamping ensures that TCP sessions negotiate a smaller MSS, preventing fragmentation and packet loss while keeping the VPN secure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Adjust the tunnel interface MTU and TCP MSS clamping on the tunnel interface.
Why this is correct
Lowering the tunnel interface MTU and configuring TCP MSS clamping ensures that packets are sized appropriately before encryption and encapsulation, preventing fragmentation or drops. This maintains security because the packets are still encrypted and encapsulated correctly. It is a standard best practice for IPsec VPNs to account for the additional overhead of IPsec and GRE headers, especially when the underlying path has a lower MTU.
- ✗
Enable path MTU discovery (PMTUD) on the tunnel and rely on ICMP unreachable messages.
Why it's wrong here
While PMTUD can help, it is often unreliable because many networks filter ICMP unreachable messages, which are required for PMTUD to function. In IPsec VPNs, PMTUD may not work end-to-end due to security policies. Relying solely on PMTUD is risky; explicit MTU and MSS clamping is more deterministic. Thus, this action alone may not resolve the problem.
- ✗
Increase the IP MTU on the physical interface to accommodate larger packets.
Why it's wrong here
Increasing the physical interface MTU may not be possible if the underlying transport does not support it, and it does not address the fundamental issue of encapsulation overhead. The physical interface MTU is often fixed by the service provider. The correct approach is to adjust the tunnel MTU and MSS to fit within the physical MTU after encapsulation, not to increase the physical MTU.
- ✗
Disable IPsec encryption on the tunnel to eliminate overhead.
Why it's wrong here
Disabling encryption would remove the security of the VPN and is not a valid solution for an MTU issue. It would expose traffic and violate security policies. The problem stems from packet size exceeding the path MTU after encryption, not from encryption itself. Proper MTU and MSS adjustments can resolve the issue without compromising confidentiality or integrity.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 300-410 question is part of Courseiva's 1,401-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Cisco exam blueprint
This 300-410 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 300-410 exam.