hardMultiple ChoiceObjective-mapped
220-1201 Practice Question: A company's network uses a 10.0.0.0/8 private IP…
A company's network uses a 10.0.0.0/8 private IP scheme. A remote user connects via VPN and gets an IP of 172.16.0.5. They can access the internet but cannot reach internal servers at 10.1.1.50. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN client is using split tunneling and no route to 10.0.0.0/8 is defined.
The VPN client receives a different subnet (172.16.0.0) than the internal network (10.0.0.0). This is a routing issue—the VPN client's traffic to the internal network may not be routed correctly, or split tunneling is misconfigured. The most common fix is to ensure the VPN routes include the internal subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The internal server's firewall is blocking the VPN IP range.
Why it's wrong here
While a server-side firewall *could* block specific traffic, the scenario describes a general inability to reach *any* internal resource after establishing a VPN connection. If the issue were a single server's firewall, other internal resources would likely remain accessible. This points more strongly to a fundamental routing problem preventing traffic from reaching the internal network segment at all, rather than a specific server rejecting the connection.
- ✓
The VPN client is using split tunneling and no route to 10.0.0.0/8 is defined.
Why this is correct
Split tunneling is a VPN configuration where only traffic explicitly destined for corporate networks (defined by routes pushed by the VPN server) traverses the encrypted tunnel. All other traffic, such as general internet browsing, bypasses the VPN. If the VPN server fails to push the necessary route for the company's 10.0.0.0/8 internal subnet, the client's operating system will attempt to route that traffic via its local default gateway, which cannot reach the private corporate network, thus preventing access.
- ✗
The VPN server's DHCP scope is exhausted.
Why it's wrong here
If the VPN server's DHCP scope were exhausted, the VPN client would be unable to obtain an IP address for the tunnel interface, preventing the VPN connection from fully establishing. The problem implies the user *can* connect to the VPN but cannot reach internal resources, meaning an IP address was successfully assigned. Therefore, the DHCP scope is not exhausted, and this is not the cause of the routing issue.
- ✗
The user's DNS server is set to a public DNS like 8.8.8.8.
Why it's wrong here
DNS (Domain Name System) is solely responsible for translating human-readable hostnames into IP addresses. The inability to reach internal resources, even by direct IP address (implied by "cannot reach internal resources"), indicates a fundamental network connectivity or routing problem, not a name resolution issue. If direct IP communication fails, changing DNS settings would not resolve the underlying problem.
Visual reference
Go deeper
Related to this question
Learn chapter
TCP/IP and Common Ports for A+
Key term
CAN
A CAN (Controller Area Network) is a robust vehicle bus standard designed to allow microcontrollers and devices to communicate with each other without a host computer.
Key term
Subnet
A subnet is a logical subdivision of an IP network, created by partitioning a larger network address space using subnet masks.
About these practice questions
One of 972 original 220-1201 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.