mediumMultiple ChoiceObjective-mapped
CISSP Practice Question: Is troubleshooting a network where internal users…
A security engineer is troubleshooting a network where internal users can access internet websites but cannot reach the company's external VPN server (IP 203.0.113.50, UDP port 500). The firewall rule for VPN traffic is correctly configured. What is the most likely cause?
⚠ Common exam trap
Many exam-takers assume a firewall misconfiguration (like stateful blocking or wrong interface) is the cause, but the question explicitly states the firewall rule is correctly configured, forcing you to look at the endpoint itself—a classic CISSP test of reading comprehension and layered troubleshooting.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The VPN server is not listening on UDP port 500.
The symptom—internal users can reach internet websites but cannot reach the external VPN server—indicates a host-level issue rather than a network or firewall problem. Since the firewall rule for VPN traffic is correctly configured and other traffic flows normally, the most likely cause is that the VPN server itself is not listening on UDP port 500, which is the standard port for IPsec IKE (Internet Key Exchange) traffic. This could be due to a misconfiguration, service failure, or the server being configured to use a different port or protocol.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The VPN server is using TCP port 443 instead of UDP 500.
Why it's wrong here
Internet Key Exchange (IKE), the protocol typically used for establishing IPsec VPN tunnels, primarily operates over UDP port 500 for initial key negotiation and security association establishment. While some VPN solutions can encapsulate IPsec over TCP port 443 (e.g., for traversing restrictive firewalls), the default and expected behavior for IKE is UDP 500. If the server is configured to use TCP 443 for IKE, it would not respond to standard IKE client requests directed at UDP 500, leading to connection failure.
- ✗
The firewall rule is applied to the wrong interface.
Why it's wrong here
If the firewall rule is correctly configured as stated in the question stem, then applying it to the wrong interface is not the issue. Firewall rules must be precisely associated with the network interfaces through which the relevant traffic flows, both inbound and outbound. A misapplied rule would either fail to filter the intended traffic or incorrectly block legitimate traffic, but the premise here is that the rule itself is correct.
- ✗
The firewall is stateful and blocking the return traffic.
Why it's wrong here
Stateful firewalls maintain a connection table, tracking the state of active network connections. Once an outbound connection is initiated and allowed, the firewall automatically permits the corresponding return traffic for that established session, without requiring an explicit inbound rule. Therefore, a stateful firewall would not block return traffic for a legitimate, initiated VPN connection attempt, making this an unlikely cause for connection issues.
- ✓
The VPN server is not listening on UDP port 500.
Why this is correct
For a VPN client to successfully initiate a connection, the VPN server must have its VPN service actively running and configured to listen for incoming connection requests on the expected port, typically UDP port 500 for IKE. If the service is stopped, crashed, or misconfigured to listen on a different port or interface, the server will not respond to client connection attempts on UDP port 500. This lack of response will cause the client to time out, indicating a server-side availability issue.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
Firewall
A firewall is a network security system that monitors and controls incoming and outgoing traffic based on predetermined security rules to protect trusted internal networks from untrusted external networks.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.