mediumMultiple ChoiceObjective-mapped
CAS-004 Practice Question: A security architect is designing a secure remote…
A security architect is designing a secure remote access solution for a global workforce. The company requires that all remote connections be authenticated using certificates issued by the company's internal PKI, and that the connection be encrypted and integrity-protected. Additionally, the solution must support IP-based network access control to restrict access to specific internal subnets based on the user's role. Which of the following should the architect recommend?
⚠ Common exam trap
Many candidates choose SSL/TLS VPN (Option B) because it is commonly associated with certificate authentication, but they overlook the critical requirement for IP-based network access control enforced by the server, not the client.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.
An IPsec VPN with certificate-based authentication satisfies the requirement for encrypted, integrity-protected connections using the company's internal PKI. Integrating with a RADIUS server enables role-based IP access control, allowing the VPN gateway to restrict access to specific internal subnets based on the user's role, which aligns with the need for IP-based network access control.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy SSH tunneling with certificate-based authentication and configure iptables rules on the bastion host.
Why it's wrong here
SSH tunnels are for port forwarding, not full IP routing; iptables rules are complex and not scalable.
- ✗
Deploy an SSL/TLS VPN using client certificates and rely on the VPN client to enforce access policies.
Why it's wrong here
SSL VPNs are application-layer and typically cannot enforce IP subnet restrictions; policy enforcement is server-side.
- ✗
Deploy a RDP gateway with certificate authentication and restrict access via group policies.
Why it's wrong here
RDP is for remote desktop sessions, not general network access; group policies cannot restrict IP subnets dynamically.
- ✓
Deploy an IPsec VPN with certificate-based authentication and integrate with a RADIUS server for role-based access control.
Why this is correct
IPsec provides network-layer access, RADIUS can enforce subnet restrictions based on user role.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 968 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.