hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is tasked with securing a legacy web…
A technician is tasked with securing a legacy web application that only supports HTTP, not HTTPS. The application is critical for internal operations but must be accessible remotely. What is the best way to secure the traffic without modifying the application?
⚠ Common exam trap
A common misconception is that installing a certificate or enabling a security header can magically convert an HTTP-only application to HTTPS, when in fact the application must natively support TLS termination to use those features.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPN to access the internal network.
A VPN creates an encrypted tunnel between the remote user and the internal network, securing all HTTP traffic without any modification to the legacy application. Since the application only supports HTTP, it cannot serve HTTPS natively, and a VPN provides transport-layer encryption (e.g., IPsec or TLS-based VPN) that protects data in transit over untrusted networks.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Install a self-signed SSL certificate on the server.
Why it's wrong here
Installing a self-signed SSL certificate on the server enables HTTPS, but the legacy application itself must be configured to serve content over HTTPS. If the application only speaks HTTP, simply installing a certificate won't magically make the application use encryption. Furthermore, self-signed certificates are not trusted by browsers by default, leading to security warnings, which is not a secure solution for production environments.
- ✓
Use a VPN to access the internal network.
Why this is correct
A Virtual Private Network (VPN) establishes an encrypted tunnel between the client and the internal network. All traffic, including unencrypted HTTP requests to the legacy web application, traverses this secure tunnel. This effectively encapsulates and protects the HTTP communication from external eavesdropping and tampering, providing confidentiality and integrity for the data without requiring any modifications to the legacy application or server configuration.
- ✗
Enable HTTP Strict Transport Security (HSTS) on the server.
Why it's wrong here
HTTP Strict Transport Security (HSTS) is a security policy mechanism that web servers use to declare that web browsers should only interact with them using secure HTTPS connections, never via HTTP. Since the legacy web application in question only supports HTTP, enabling HSTS would prevent browsers from accessing it entirely, as HSTS explicitly forbids unencrypted HTTP connections and redirects all attempts to HTTPS, which the application cannot handle.
- ✗
Configure the browser to use a proxy server.
Why it's wrong here
Configuring a browser to use a standard HTTP proxy server primarily routes traffic through an intermediary, which can offer benefits like caching or access control. However, a basic HTTP proxy does not inherently encrypt the communication between the client and the proxy server, nor between the proxy and the destination web server if the original request is HTTP. Therefore, the unencrypted HTTP traffic to the legacy web application would still be vulnerable to interception and eavesdropping at various points along the path.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Data Destruction and Disposal
Key term
IPsec
IPsec is a suite of protocols used to secure Internet Protocol (IP) communications by encrypting and authenticating each IP packet in a data stream.
Key term
VPN
A VPN creates an encrypted tunnel over a public network to securely connect remote users or sites to a private network.
About these practice questions
This 220-1202 question is part of Courseiva's 495-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.