CISSP Communication and Network Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use IPsec in transport mode for better performance

  Why it's wrong here

  SSL VPNs operate using the Transport Layer Security (TLS) protocol, typically at the application layer (OSI Layer 6/7), to create an encrypted tunnel for data. In contrast, IPsec is a distinct suite of protocols that operates at the network layer (OSI Layer 3) and is used for securing IP communications. Suggesting IPsec in transport mode, which primarily encrypts the payload of an IP packet, for an SSL VPN demonstrates a fundamental misunderstanding of these separate VPN technologies and their underlying mechanisms.

• ✓

  Implement strong authentication mechanisms such as multi-factor authentication

  Why this is correct

  Implementing strong authentication, such as multi-factor authentication (MFA), is paramount for SSL VPNs because the gateway often presents an internet-facing web portal, making it a prime target for credential-based attacks. MFA adds a crucial layer of security by requiring users to provide two or more verification factors, significantly reducing the risk of unauthorized access even if a user's password is compromised. This protection is vital for safeguarding the internal network resources accessible via the VPN.

• ✓

  Ensure the SSL VPN gateway is patched and hardened against web application attacks

  Why this is correct

  The SSL VPN gateway functions as an internet-facing web application, making it inherently vulnerable to common web-based attacks like SQL injection, cross-site scripting (XSS), and buffer overflows. Regularly patching the gateway addresses known security vulnerabilities that attackers could exploit to gain unauthorized access or control. Hardening involves configuring the system securely, disabling unnecessary services, and implementing robust security controls to minimize the attack surface and prevent compromise of the critical access point.

• ✗

  Use pre-shared keys for authentication

  Why it's wrong here

  Pre-shared keys (PSKs) are a static secret primarily used in IPsec VPNs for authenticating the VPN endpoints themselves, not for individual user authentication in an SSL VPN context. SSL VPNs are designed for scalable remote user access and rely on more granular, user-specific authentication methods such as username/password combinations, often augmented by client certificates or tokens. Using PSKs for individual users would be impractical, insecure due to key distribution challenges, and lack the necessary user-level accountability and access control.

• ✗

  Disable encryption to improve speed

  Why it's wrong here

  Disabling encryption completely defeats the fundamental purpose of a Virtual Private Network (VPN), which is to establish a secure, confidential, and integrity-protected communication channel over an untrusted network like the internet. Without encryption, all data transmitted through the VPN tunnel would be sent in plaintext, making it vulnerable to eavesdropping, interception, and tampering by any malicious actor on the network. This would expose sensitive corporate data and user credentials, rendering the VPN useless for security.

Go deeper

Related to this question