easyMultiple Choice
CISSP Practice Question: A company has a headquarters and three branch…
A company has a headquarters and three branch offices connected via MPLS VPN. Recently, they deployed a new VoIP system across all sites. Users report intermittent call drops and poor voice quality during peak business hours. The network team suspects packet loss and jitter are the cause. The IT manager wants to verify the issue without affecting production traffic. Which of the following is the best course of action?
⚠ Common exam trap
CISSP often tests the difference between active monitoring (IP SLA, synthetic probes) and passive monitoring (packet capture, SPAN) — candidates pick packet capture because it sounds thorough, but it is disruptive and does not generate controlled test conditions for jitter and loss measurement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IP SLA to generate test traffic and measure jitter and packet loss.
IP SLA (Internet Protocol Service Level Agreement) is a Cisco IOS feature that generates synthetic test traffic to measure network performance metrics — including jitter, latency, packet loss, and round-trip time — without impacting production traffic. It is the standard tool for proactively verifying VoIP quality issues on MPLS networks. This directly addresses the suspected packet loss and jitter without disrupting users.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Deploy a full packet capture on all branch routers.
Why it's wrong here
Deploying a full packet capture on all branch routers is highly resource-intensive, consuming significant CPU, memory, and storage. This can severely degrade router performance, potentially exacerbating network issues rather than diagnosing them. It is generally unsuitable for continuous, proactive performance monitoring across multiple locations due to its overhead and the sheer volume of data generated, making it more appropriate for targeted, short-term troubleshooting.
- ✓
Use IP SLA to generate test traffic and measure jitter and packet loss.
Why this is correct
IP Service Level Agreements (SLA) actively generate synthetic traffic, mimicking real application flows like VoIP or video, to measure specific performance metrics. This non-intrusive method allows for precise measurement of jitter, latency, and packet loss without impacting live production traffic. By simulating actual application behavior, IP SLA provides a clear baseline and ongoing insight into network quality, making it ideal for proactive performance assessment and identifying subtle degradations.
- ✗
Conduct a network assessment by duplicating traffic to a monitoring tool.
Why it's wrong here
Duplicating traffic, often via port mirroring (SPAN/RSPAN), to a monitoring tool can introduce significant overhead on the source network device, potentially affecting its performance and introducing latency. While useful for reactive troubleshooting or security analysis, it may not capture all relevant traffic accurately across a complex WAN and is not designed for isolating specific performance degradations like jitter. This method provides a snapshot rather than continuous, targeted performance metrics needed for proactive quality assessment.
- ✗
Increase the MPLS bandwidth immediately.
Why it's wrong here
Increasing MPLS bandwidth immediately, without prior diagnosis, is a reactive and potentially costly measure that may not address the underlying root cause of performance issues. Problems like high jitter or packet loss are often indicative of Quality of Service (QoS) misconfigurations, congestion management issues, or application-specific behaviors, rather than simply insufficient raw throughput. A premature bandwidth upgrade would likely be an inefficient expenditure if the actual problem lies elsewhere in the network's configuration or design.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This CISSP question is part of Courseiva's 816-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.