mediumMultiple ChoiceObjective-mapped
Best VPN Protocol: Single UDP Port for Remote Access
A network administrator needs to allow secure remote access for teleworkers. Which VPN protocol provides the best confidentiality and integrity while using a single UDP port?
Quick Answer
The answer is SSL/TLS (OpenVPN) because it delivers the best confidentiality and integrity for remote access while using a single UDP port, typically port 1194. This protocol wraps traffic in TLS encryption, such as AES-256-GCM, and adds HMAC authentication, ensuring data remains private and unaltered as it traverses the internet. On the ISC2 Certified in Cybersecurity CC exam, this question tests your understanding of how VPN protocols handle firewall traversal and port simplicity—a common trap is choosing IPsec, which often requires multiple ports or protocols like ESP and IKE, making it less ideal for teleworkers behind restrictive NAT. Remember that SSL/TLS operates at the transport layer, so it behaves like HTTPS traffic, easily slipping through firewalls that block other protocols. A quick memory tip: think “Single UDP, Strong SSL” to recall that OpenVPN uses one UDP port and TLS for robust security, making it the go-to for simple, secure remote access.
⚠ Common exam trap
ISC2 often tests the misconception that L2TP/IPsec is the best for secure remote access because it is commonly used in site-to-site VPNs, but the key constraint here is 'single UDP port,' which eliminates L2TP/IPsec and IKEv2, and PPTP is insecure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL/TLS (OpenVPN)
SSL/TLS (OpenVPN) is correct because it provides robust confidentiality and integrity through TLS encryption (e.g., AES-256-GCM) and HMAC authentication, while operating over a single UDP port (typically 1194). This makes it ideal for teleworkers as it can traverse NAT and firewalls easily, unlike protocols that require multiple ports or IPsec's complex port/protocol handling.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
PPTP
Why it's wrong here
PPTP uses TCP port 1723 and has known security vulnerabilities.
- ✓
SSL/TLS (OpenVPN)
Why this is correct
OpenVPN uses a single UDP port and provides strong encryption.
- ✗
L2TP/IPsec
Why it's wrong here
L2TP/IPsec uses multiple UDP ports (500, 4500, 1701) and is complex.
- ✗
IKEv2
Why it's wrong here
IKEv2 uses UDP ports 500 and 4500.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Authentication and Authorization Methods
Key term
Advanced Encryption Standard
Advanced Encryption Standard (AES) is a widely used symmetric encryption algorithm that protects electronic data by converting readable information into a scrambled format that can only be unscrambled with the correct secret key.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
Courseiva writes every CC question from scratch — 976 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CC
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A network administrator needs to provide secure remote access to internal resources for employees working from home. The solution must encrypt all traffic and authenticate users before granting access. Which protocol should be used?
easy- A.SSH
- B.IPsec
- ✓ C.SSL/TLS VPN
- D.SNMPv3
Why C: C is correct because SSL/TLS VPNs (e.g., Cisco AnyConnect) provide encrypted tunnels over HTTPS (port 443) and support user authentication via certificates, RADIUS, or LDAP. This allows secure remote access to internal resources without requiring a persistent IPsec tunnel, making it ideal for home workers with dynamic IPs.
Variation 2. A company wants to allow remote employees to securely access internal resources over the internet. Which technology is most appropriate?
easy- A.NAT
- B.VLAN
- C.DMZ
- ✓ D.VPN
Why D: A VPN (Virtual Private Network) creates an encrypted tunnel over the internet, typically using protocols like IPsec or TLS, to securely connect remote users to internal resources. This ensures confidentiality, integrity, and authentication of data in transit, making it the standard solution for remote access security.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CC practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CC exam.