CISSP Practice Question: Is troubleshooting a slow VPN connection between…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Packet loss due to link congestion

  Why it's wrong here

  Link congestion typically results in highly variable throughput and increased latency, as network devices buffer packets until their capacity is exceeded, leading to drops. This dynamic behavior would manifest as fluctuating speeds and intermittent connection issues, rather than a consistently stable, but low, 20 Mbps throughput. A stable 20 Mbps suggests a hard limit imposed by a specific component, not the unpredictable nature of network congestion.

• ✓

  CPU bottleneck on the VPN endpoints

  Why this is correct

  VPN encryption and decryption, particularly with strong algorithms like AES-256, are computationally intensive processes that heavily utilize the CPU on the VPN endpoints. If the VPN devices (routers, firewalls, or servers) have insufficient CPU power, they cannot process the encrypted traffic fast enough, regardless of available network bandwidth. This creates a fixed processing ceiling, resulting in a consistently limited throughput, such as the observed 20 Mbps, even if the underlying link could support much higher speeds.

• ✗

  MTU mismatch causing fragmentation

  Why it's wrong here

  An MTU mismatch between network segments can lead to excessive packet fragmentation and subsequent reassembly failures or packet drops, particularly when the "Don't Fragment" bit is set. While this would severely degrade performance, it typically manifests as intermittent connectivity, dropped connections, or very low, erratic throughput due to the constant overhead of retransmissions and discarded fragments. It is unlikely to produce a consistently stable, albeit slow, 20 Mbps connection, which points to a more consistent bottleneck.

• ✗

  Incorrect TCP window scaling

  Why it's wrong here

  TCP window scaling is crucial for optimizing throughput over high-latency or high-bandwidth links by allowing larger receive windows, thereby keeping the pipeline full. An incorrect or disabled TCP window scaling might limit throughput, especially over long-distance VPNs, but it typically results in a throughput ceiling determined by the bandwidth-delay product, which might not be a precise 20 Mbps. Furthermore, while it can reduce efficiency, it's less likely to impose such a rigid and consistent throughput cap compared to a fundamental hardware limitation like CPU processing power.

Go deeper

Related to this question