mediumMultiple ChoiceObjective-mapped
220-1201 Practice Question: A network administrator is configuring a new…
A network administrator is configuring a new firewall to allow remote employees to securely access internal resources. The requirement is to encrypt all traffic between the remote client and the internal network. Which protocol should be used?
⚠ Common exam trap
A common misconception is that SSL/TLS is sufficient for full network-layer encryption, when in fact it only secures individual application sessions, whereas IPsec is the standard for encrypting all traffic between a remote client and an internal network.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IPsec
IPsec is the correct choice because it provides end-to-end encryption at the network layer (Layer 3), securing all IP traffic between a remote client and an internal network. It operates in tunnel mode to encapsulate the entire original IP packet, ensuring confidentiality, integrity, and authentication for remote access VPNs. SSL/TLS operates at the transport layer and is typically used for securing individual application sessions (e.g., HTTPS), not for encrypting all traffic from a remote client to an entire internal network.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
SSL/TLS
Why it's wrong here
SSL/TLS (Secure Sockets Layer/Transport Layer Security) primarily operates at the application layer, securing communication between a client and a server, most commonly for web traffic via HTTPS. While TLS can underpin certain VPN solutions like OpenVPN, it is not the standard protocol suite a network administrator would typically configure on a firewall for a comprehensive, network-layer VPN tunnel to an internal network. Its focus is on securing individual application sessions rather than encapsulating entire network traffic streams.
- ✓
IPsec
Why this is correct
IPsec (Internet Protocol Security) is a robust suite of protocols operating at the network layer, specifically designed to secure IP communications by encrypting and authenticating each IP packet. It is the industry standard for creating secure VPN tunnels, supporting both site-to-site and remote access connections. A firewall commonly utilizes IPsec to establish secure, encrypted links to internal networks, ensuring data confidentiality and integrity across untrusted networks.
- ✗
L2TP
Why it's wrong here
L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol that operates at the Data Link Layer, primarily responsible for creating the tunnel itself. However, L2TP does not inherently provide encryption or strong authentication mechanisms on its own, making it unsuitable for secure remote access in isolation. For robust security, L2TP is almost always paired with IPsec, forming an L2TP/IPsec VPN, where IPsec provides the necessary encryption and authentication.
- ✗
HTTP
Why it's wrong here
HTTP (Hypertext Transfer Protocol) is an application-layer protocol used for transmitting unencrypted web pages and other content over the internet. It lacks any built-in encryption, authentication, or integrity checks, making it fundamentally insecure for transmitting sensitive data or establishing a secure remote access connection. Therefore, HTTP is entirely inappropriate for configuring a secure VPN tunnel to an internal network.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Network Configuration: IP, DNS, DHCP
Key term
Packet
A packet is a small unit of data that is sent over a network, containing both the actual data and control information for delivery.
Key term
HTTPS
HTTPS (Hypertext Transfer Protocol Secure) is the secure version of HTTP that encrypts data between a web browser and a web server using SSL/TLS protocols.
About these practice questions
Courseiva writes every 220-1201 question from scratch — 972 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1201 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1201 exam.