hardMultiple Choice
220-1201 Practice Question: A company's network uses a 10.0.0.0/8 private IP…
A company's network uses a 10.0.0.0/8 private IP scheme. A remote user connects via VPN and gets an IP of 172.16.0.5. They can access the internet but cannot reach internal servers at 10.1.1.50. What is the most likely cause?
⚠ Common exam trap
220-1201 often tests the difference between split tunneling and full tunneling, tricking candidates into blaming DNS or firewalls when the real issue is a missing route for the internal network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN client is using split tunneling and no route to 10.0.0.0/8 is defined.
Split tunneling allows the VPN client to send only traffic destined for specific networks through the VPN tunnel, while other traffic goes directly to the internet. If the VPN configuration does not include a route for the 10.0.0.0/8 network, the client will not send packets for 10.1.1.50 through the tunnel, and they will be dropped or routed to the internet, failing to reach internal servers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The internal server's firewall is blocking the VPN IP range.
Why it's wrong here
While a server-side firewall *could* block specific traffic, the scenario describes a general inability to reach *any* internal resource after establishing a VPN connection. If the issue were a single server's firewall, other internal resources would likely remain accessible. This points more strongly to a fundamental routing problem preventing traffic from reaching the internal network segment at all, rather than a specific server rejecting the connection.
- ✓
The VPN client is using split tunneling and no route to 10.0.0.0/8 is defined.
Why this is correct
Split tunneling is a VPN configuration where only traffic explicitly destined for corporate networks (defined by routes pushed by the VPN server) traverses the encrypted tunnel. All other traffic, such as general internet browsing, bypasses the VPN. If the VPN server fails to push the necessary route for the company's 10.0.0.0/8 internal subnet, the client's operating system will attempt to route that traffic via its local default gateway, which cannot reach the private corporate network, thus preventing access.
- ✗
The VPN server's DHCP scope is exhausted.
Why it's wrong here
If the VPN server's DHCP scope were exhausted, the VPN client would be unable to obtain an IP address for the tunnel interface, preventing the VPN connection from fully establishing. The problem implies the user *can* connect to the VPN but cannot reach internal resources, meaning an IP address was successfully assigned. Therefore, the DHCP scope is not exhausted, and this is not the cause of the routing issue.
- ✗
The user's DNS server is set to a public DNS like 8.8.8.8.
Why it's wrong here
DNS (Domain Name System) is solely responsible for translating human-readable hostnames into IP addresses. The inability to reach internal resources, even by direct IP address (implied by "cannot reach internal resources"), indicates a fundamental network connectivity or routing problem, not a name resolution issue. If direct IP communication fails, changing DNS settings would not resolve the underlying problem.
Go deeper
Related to this question
About these practice questions
One of 871 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.