mediumMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is configuring a VPN for a remote…
A technician is configuring a VPN for a remote user. The user's home router uses NAT, and the technician wants to ensure the VPN traffic is encapsulated and encrypted. Which VPN protocol should the technician choose for the best balance of security and compatibility?
⚠ Common exam trap
CompTIA often tests the misconception that L2TP/IPsec is always the best for security and compatibility, but the trap here is that IPsec's ESP protocol can fail with NAT unless NAT-T is enabled, making OpenVPN a more practical choice for remote users behind home routers.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
OpenVPN
OpenVPN is the correct choice because it provides a robust balance of security and compatibility, especially for remote users behind NAT. It uses SSL/TLS for encryption and can operate over a single UDP or TCP port (typically 1194), which easily traverses NAT without requiring additional configuration. Unlike L2TP/IPsec, OpenVPN does not rely on IPsec's NAT-sensitive protocols like ESP, making it more reliable across home routers.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PPTP
Why it's wrong here
PPTP (Point-to-Point Tunneling Protocol) is an older VPN protocol that operates at Layer 2 of the OSI model and encapsulates PPP frames over IP. While simple to set up, it utilizes weak encryption methods, often relying on MS-CHAPv2 for authentication, which has been demonstrated to be vulnerable to brute-force attacks. Due to these significant security flaws, PPTP is considered obsolete and should never be used for secure remote access, making it an unsuitable choice for a modern VPN configuration.
- ✗
L2TP/IPsec
Why it's wrong here
L2TP/IPsec combines the tunneling capabilities of L2TP with the robust security features of IPsec, providing strong encryption and authentication. However, L2TP/IPsec often encounters difficulties traversing Network Address Translation (NAT) devices, particularly when multiple NAT layers are involved, because IPsec uses UDP port 500 for IKE and ESP protocol 50, which can be problematic for NAT routers to correctly forward. This can necessitate complex firewall rule adjustments or specific router configurations, making it less straightforward for universal deployment in varied network environments.
- ✓
OpenVPN
Why this is correct
OpenVPN is an open-source VPN solution that leverages the OpenSSL library for robust encryption and authentication, supporting a wide range of cryptographic algorithms. It is highly flexible, capable of operating over both UDP and TCP protocols, which allows it to effectively traverse firewalls and Network Address Translation (NAT) devices by encapsulating traffic within standard ports like 443. Its strong security, cross-platform compatibility, and extensive configurability make it an excellent and reliable choice for secure remote access.
- ✗
SSTP
Why it's wrong here
SSTP (Secure Socket Tunneling Protocol) is a Microsoft-developed VPN protocol that encapsulates PPP traffic over an SSL/TLS channel, utilizing TCP port 443, similar to HTTPS. While this allows it to bypass most firewalls and NAT devices effectively, its primary drawback is its proprietary nature and strong ties to the Windows ecosystem. This makes client support and server implementations less ubiquitous across non-Windows operating systems and network devices, limiting its universal compatibility and making it a less flexible choice for diverse environments compared to open-source alternatives.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Windows Security Features
Key term
Internet Protocol Security
Internet Protocol Security (IPsec) is a suite of protocols that encrypts and authenticates data packets sent over IP networks to ensure private and secure communication.
Key term
Transport Layer Security
Transport Layer Security (TLS) is a cryptographic protocol that provides secure, encrypted communication between two devices over a network, such as between a web browser and a server.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.