easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Provide secure remote access to employees using…
A company needs to provide secure remote access to employees using company-issued laptops. The solution must support both web applications and legacy client-server apps without installing client software on the laptops. Which VPN technology is best?
⚠ Common exam trap
It's easy for candidates to assume IPsec (Option D) is the only 'secure' VPN option and overlook that SSL VPNs can provide equivalent security with clientless access, or they confuse MPLS (Option C) as a remote access solution when it is actually a WAN technology for site-to-site connectivity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
SSL VPN with clientless web access and port forwarding
SSL VPN with clientless web access and port forwarding is the best choice because it meets the requirement of supporting both web applications and legacy client-server apps without installing client software. Clientless web access provides secure HTTPS-based access to internal web applications via a browser, while port forwarding allows legacy TCP-based client-server applications to be tunneled through the SSL VPN without requiring a full VPN client on the laptop. This approach leverages the existing browser and OS capabilities, eliminating the need for additional software installation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
SSL VPN with clientless web access and port forwarding
Why this is correct
SSL VPNs with clientless web access leverage standard web browsers to provide secure, encrypted access to web-based applications without requiring dedicated client software installation. For legacy or non-web applications, they can utilize port forwarding, often through a lightweight browser plugin or a small downloadable client, to securely tunnel traffic. This hybrid approach offers significant flexibility, meeting diverse remote access needs by supporting both clientless browser-based access and client-assisted access for other protocols.
- ✗
L2TP over IPsec
Why it's wrong here
L2TP over IPsec combines the Layer 2 tunneling capabilities of L2TP with the robust encryption and authentication provided by IPsec. Establishing this secure tunnel typically requires a dedicated VPN client software installed on the user's device. This client is responsible for encapsulating L2TP frames within IPsec packets, performing cryptographic operations, and managing the secure connection, thus making it a client-dependent solution unsuitable for clientless access.
- ✗
MPLS Layer 3 VPN
Why it's wrong here
MPLS Layer 3 VPNs are a core Wide Area Network (WAN) technology primarily used by service providers to create secure, private network segments for connecting multiple geographically dispersed corporate sites. They operate by routing traffic between customer edge (CE) routers over a shared MPLS backbone, providing site-to-site connectivity. This technology is designed for network-to-network integration, not for individual remote users connecting from arbitrary internet locations to a corporate network.
- ✗
IPsec tunnel mode
Why it's wrong here
IPsec in tunnel mode encapsulates the entire original IP packet, including its header, within a new IP packet, which is then encrypted and authenticated before transmission. This comprehensive encapsulation and cryptographic processing necessitate a full IPsec client on the remote user's device. The client is essential for performing the encapsulation, encryption, decryption, and de-encapsulation processes, making it a client-dependent solution that does not support clientless access directly through a web browser.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Cryptography and Its Applications
Key term
SSL VPN
An SSL VPN is a virtual private network that uses the Secure Sockets Layer protocol to create an encrypted tunnel for remote users to securely access network resources over the internet.
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.