mediumMultiple ChoiceObjective-mapped
220-1202 Practice Question: A system administrator configures a new VPN…
A system administrator configures a new VPN server for remote employees. The requirement is that all traffic from the remote user's device must be routed through the corporate network to enforce security policies. Which VPN protocol setting should the administrator enable?
⚠ Common exam trap
CompTIA often tests the misconception that the choice of VPN protocol (PPTP vs. L2TP) determines traffic routing behavior, when in fact split tunneling is a separate policy setting that must be explicitly enabled or disabled.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Disable split tunneling
Disabling split tunneling ensures that all traffic from the remote user's device is routed through the corporate VPN tunnel, enforcing security policies such as content filtering and intrusion detection. When split tunneling is enabled, only traffic destined for the corporate network goes through the VPN, while internet-bound traffic bypasses it, violating the requirement. This setting is typically configured in the VPN client or server profile (e.g., using the 'DisableSplitTunneling' registry key on Windows or the 'tunnel-all' directive in OpenVPN).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable split tunneling
Why it's wrong here
Enabling split tunneling would configure the VPN client to route traffic destined for the corporate network through the secure tunnel, while allowing all other internet-bound traffic to bypass the VPN and go directly to the internet. This configuration would explicitly prevent all traffic from being subject to corporate security policies and monitoring, which contradicts the goal of ensuring comprehensive security control over all user activity. Therefore, it is the opposite of what is needed to enforce full corporate security.
- ✓
Disable split tunneling
Why this is correct
Disabling split tunneling, also known as implementing a full tunnel VPN, forces all network traffic originating from the client device to traverse the secure VPN tunnel to the corporate network before reaching any destination, including the public internet. This ensures that every packet is subjected to the organization's security controls, such as firewalls, intrusion detection systems, and content filters, thereby enforcing comprehensive corporate security policies on all user activity. This configuration is essential when the objective is to secure and monitor all outbound traffic.
- ✗
Use PPTP instead of L2TP
Why it's wrong here
The choice between PPTP (Point-to-Point Tunneling Protocol) and L2TP (Layer 2 Tunneling Protocol) primarily concerns the level of security, encryption strength, and compatibility, not the routing decision of whether all traffic goes through the VPN. PPTP is an older, less secure protocol with known vulnerabilities, while L2TP typically relies on IPsec for robust encryption and authentication. Neither protocol inherently dictates a full tunnel or split tunnel configuration; that is a separate routing policy setting on the VPN server and client.
- ✗
Increase the MTU size
Why it's wrong here
Increasing the Maximum Transmission Unit (MTU) size primarily affects the maximum size of packets that can be transmitted across a network path without fragmentation, impacting network performance and efficiency. While an incorrectly configured MTU can lead to packet fragmentation issues and reduced throughput, it does not determine *how* traffic is routed—specifically, whether all traffic is forced through the VPN tunnel or allowed to bypass it. Adjusting MTU is a performance optimization, not a security or traffic policy enforcement mechanism.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 220-1202 question from scratch — 495 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.