hardMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is configuring a network for a…
A technician is configuring a network for a branch office that will use a router to connect to the main office over the internet. The connection must be encrypted and authenticated to ensure data privacy. Which protocol should the technician configure on the router?
⚠ Common exam trap
Many candidates confuse L2TP with a complete VPN solution, forgetting that L2TP alone provides no encryption and must be paired with IPsec to meet security requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IPsec
IPsec is the correct protocol because it provides both encryption and authentication at the network layer, making it ideal for securing site-to-site VPN connections over the internet. It ensures data privacy by encrypting the entire IP packet and authenticates the communicating peers using protocols like IKE (Internet Key Exchange). This matches the requirement for a router-to-router connection where all traffic between branch and main office must be protected.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IPsec
Why this is correct
IPsec (Internet Protocol Security) is the industry standard for securing IP communications, making it ideal for creating secure VPN tunnels between routers. It operates at the network layer (Layer 3) and provides both data confidentiality through robust encryption (e.g., AES) and data integrity/authentication using protocols like ESP (Encapsulating Security Payload) and AH (Authentication Header). This comprehensive suite of protocols ensures secure, authenticated, and encrypted communication for an entire branch network over an untrusted medium like the internet, perfectly suiting a router-to-router VPN configuration.
- ✗
SSL/TLS
Why it's wrong here
SSL/TLS (Secure Sockets Layer/Transport Layer Security) primarily operates at the application layer, securing individual application sessions like web browsing (HTTPS) or email. While some VPN solutions leverage SSL/TLS for client-to-site connections, it is generally not the preferred or most efficient protocol for establishing a persistent, secure, router-to-router tunnel connecting an entire branch office network. Its overhead and design are less optimized for network-layer packet encapsulation and full network segment security compared to IPsec.
- ✗
PPTP
Why it's wrong here
PPTP (Point-to-Point Tunneling Protocol) is an outdated VPN protocol known for significant security vulnerabilities, including weak encryption and susceptibility to various attacks. It operates by encapsulating PPP frames over IP and typically uses TCP port 1723, but its inherent weaknesses make it unsuitable for securing modern branch office communications. Due to its lack of robust security features and known exploits, it is rarely recommended or deployed in enterprise environments today for secure site-to-site VPNs.
- ✗
L2TP
Why it's wrong here
L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol that operates at the data link layer (Layer 2), primarily used for creating VPN tunnels. However, L2TP itself does not provide any encryption or strong authentication mechanisms, making it inherently insecure when used alone. For secure communications, L2TP is almost always paired with IPsec, which then provides the necessary encryption, data integrity, and authentication services to protect the encapsulated traffic, forming an L2TP/IPsec VPN solution.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 972 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.