mediumMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is tasked with securely connecting a…
A technician is tasked with securely connecting a remote office to the main office over the internet. The remote office has 10 users who need access to the same resources as local users. Which of the following remote access methods provides the most secure and scalable solution?
⚠ Common exam trap
CompTIA often tests the distinction between site-to-site and client-to-site VPNs, where candidates mistakenly choose client-to-site VPN (Option D) thinking it is more secure per-user, but the question emphasizes 'scalable' and 'connecting a remote office'—a site-to-site VPN is the correct enterprise solution for network-to-network connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set up a site-to-site VPN between the two offices
A site-to-site VPN (often using IPsec or a secure tunnel protocol) creates an encrypted, always-on connection between the two office routers, allowing all 10 users transparent access to the main office resources as if they were on the same LAN. This method is both secure (encrypting all traffic) and scalable (handling multiple users without per-client configuration), making it the best fit for connecting entire networks over the internet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure port forwarding on the main office router for each required service
Why it's wrong here
Configuring port forwarding creates direct, unencrypted pathways from the internet to specific internal services, bypassing the firewall for those designated ports. This significantly increases the attack surface, making the internal network vulnerable to external threats and unauthorized access. Furthermore, it is not scalable for multiple users needing access to various services, as each service would require its own dedicated port rule, complicating management and security.
- ✓
Set up a site-to-site VPN between the two offices
Why this is correct
A site-to-site VPN establishes a secure, encrypted tunnel between the two office networks, effectively making them appear as one contiguous network. This allows all users in the remote office to securely access resources in the main office as if they were locally connected, without individual client configuration. It provides robust network-level security and is highly scalable for connecting entire branch offices.
- ✗
Use Remote Desktop for each user to connect to a workstation at the main office
Why it's wrong here
Using Remote Desktop Protocol (RDP) for each user to connect to individual workstations at the main office provides only application-level access to a specific machine, not network-wide resource access. This approach is highly inefficient, requiring a dedicated RDP session and potentially a dedicated workstation for every user, consuming significant resources. It also introduces numerous individual endpoints that must be secured, increasing the management overhead and potential attack vectors.
- ✗
Implement a client-to-site VPN for each user
Why it's wrong here
Implementing a client-to-site VPN for each user would establish secure, encrypted tunnels from individual client devices to the main office network. While secure for individual connections, this method demands separate client software installation, configuration, and ongoing management for every single user. For a scenario involving an entire remote office needing network access, this becomes significantly less scalable and more administratively burdensome than a single site-to-site solution.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Virtualization and Client-Side
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
Key term
Internet Key Exchange
Internet Key Exchange (IKE) is a protocol used to set up a secure, encrypted connection between two devices by automatically negotiating and exchanging encryption keys over an untrusted network like the internet.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.