CISSP Practice Question: A security architect is designing a secure…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  PPTP

  Why it's wrong here

  Point-to-Point Tunneling Protocol (PPTP) is an outdated VPN protocol with significant security vulnerabilities, making it unsuitable for designing a secure communication channel. It primarily uses Microsoft Point-to-Point Encryption (MPPE) which has known cryptographic weaknesses, and its authentication relies on MS-CHAPv1/v2, which are susceptible to dictionary attacks and credential harvesting. These inherent flaws mean it cannot provide the necessary confidentiality and integrity for modern secure communications.

• ✗

  SSL/TLS

  Why it's wrong here

  While Secure Sockets Layer/Transport Layer Security (SSL/TLS) provides robust encryption and authentication, it is primarily designed for securing application-layer communications, such as web traffic, or for remote access VPNs where individual users connect to a network. For site-to-site VPNs, which typically require securing entire network segments at the network layer, SSL/TLS can be less efficient and more complex to manage compared to IPsec, as it often requires proxying or specific application configurations.

• ✓

  IPsec with ESP in tunnel mode

  Why this is correct

  IPsec with Encapsulating Security Payload (ESP) in tunnel mode is an excellent choice for securing site-to-site communication channels. ESP provides both confidentiality through encryption and integrity/authenticity through cryptographic hashing, protecting the entire original IP packet by encapsulating it within a new IP header. Tunnel mode specifically creates a secure logical tunnel between two gateways, making it ideal for connecting entire networks securely and transparently at the network layer.

• ✗

  MPLS

  Why it's wrong here

  Multiprotocol Label Switching (MPLS) is a high-performance data-carrying mechanism that directs data from one network node to the next based on short path labels rather than long network addresses. While MPLS enhances network performance and traffic engineering capabilities, it operates primarily at Layer 2.5 and inherently lacks native encryption or strong authentication mechanisms to secure data in transit. Therefore, MPLS alone does not provide a secure communication channel and requires additional security protocols like IPsec.

• ✓

  L2TP over IPsec

  Why this is correct

  Layer 2 Tunneling Protocol (L2TP) over IPsec is a robust solution for creating secure communication channels, particularly for VPNs. L2TP establishes the tunnel itself, allowing for the encapsulation of various Layer 2 protocols, while IPsec provides the essential security services, including strong encryption (confidentiality), data integrity, and authentication for the L2TP tunnel. This combination creates a highly secure and flexible VPN solution capable of protecting diverse traffic types between sites.

Go deeper

Related to this question