hardMultiple ChoiceObjective-mapped
220-1201 Practice Question: A technician is configuring a network for a new…
A technician is configuring a network for a new branch office. The branch has 50 users and needs to access resources at the main office via a secure tunnel over the internet. Which service is required to establish this connection?
⚠ Common exam trap
A common misconception is that NAT alone can provide security or remote access, but NAT only modifies address headers and does not encrypt traffic or authenticate users, making VPN the correct choice for secure tunneling.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
VPN
A VPN (Virtual Private Network) is required to create a secure, encrypted tunnel over the internet between the branch office and the main office. This allows the 50 users to access internal resources at the main office as if they were on the same local network, using protocols such as IPsec or SSL/TLS to ensure confidentiality and integrity of data in transit.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
DHCP
Why it's wrong here
DHCP (Dynamic Host Configuration Protocol) is a network protocol used on IP networks for automatically assigning IP addresses and other communication parameters to devices connected to the network. While essential for local network management and simplifying configuration, DHCP operates at the application layer to distribute network settings and does not provide any mechanisms for data encryption or creating secure, encrypted tunnels for communication across public networks like the internet.
- ✗
DNS
Why it's wrong here
DNS (Domain Name System) is a hierarchical and decentralized naming system for computers, services, or other resources connected to the Internet or a private network. Its primary function is to translate human-readable domain names into numerical IP addresses, which computers use to identify each other. DNS is a fundamental service for internet navigation but does not offer any inherent data encryption, secure tunneling, or protection for the confidentiality or integrity of data transmitted over a network.
- ✓
VPN
Why this is correct
A Virtual Private Network (VPN) establishes a secure, encrypted connection, often referred to as a "tunnel," over an unsecured network, such as the internet. This technology allows remote users or branch offices to securely access a private network, protecting data confidentiality and integrity by encapsulating and encrypting all traffic flowing through the tunnel. It effectively extends a private network across a public network, ensuring secure communication between disparate locations.
- ✗
NAT
Why it's wrong here
Network Address Translation (NAT) is a method of remapping one IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. Its primary purpose is to conserve public IPv4 addresses by allowing multiple devices on a private network to share a single public IP address when accessing the internet. While it facilitates internet access, NAT provides no inherent security features like encryption or secure tunneling for data transmission.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This 220-1201 question is part of Courseiva's 972-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.