easyMultiple ChoiceObjective-mapped
CISSP Practice Question: Wants to ensure that employees can securely…
An organization wants to ensure that employees can securely access internal applications from home. They deploy a VPN solution. Which VPN type provides the strongest encryption and is most commonly used for remote access?
⚠ Common exam trap
Many candidates confuse MPLS Layer 3 VPN (a site-to-site provider-based solution) with remote access VPNs, or they underestimate the weakness of PPTP and unencrypted L2TP, assuming any tunneling protocol provides adequate security.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
IPsec with IKEv2 and AES-256
IPsec with IKEv2 and AES-256 provides the strongest encryption for remote access VPNs. IKEv2 offers improved security features like mobility and multi-homing support, while AES-256 is a symmetric cipher with a 256-bit key that is currently considered unbreakable by brute force. This combination is widely deployed for secure client-to-site connections.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
IPsec with IKEv2 and AES-256
Why this is correct
IPsec with IKEv2 and AES-256 is the optimal choice for secure remote access, as IPsec provides robust network layer security through authentication and encryption. IKEv2 (Internet Key Exchange version 2) establishes Security Associations (SAs) and manages cryptographic keys efficiently, offering strong resistance to attacks and supporting modern features like MOBIKE for seamless roaming. AES-256 (Advanced Encryption Standard with a 256-bit key) ensures high-grade confidentiality for data in transit, making this combination a industry standard for protecting sensitive communications.
- ✗
MPLS Layer 3 VPN
Why it's wrong here
MPLS Layer 3 VPNs primarily provide traffic separation and routing isolation for different customers or departments over a shared network infrastructure. While they create logical VPNs, MPLS inherently lacks cryptographic security mechanisms to encrypt data traversing the network. Therefore, an MPLS L3 VPN alone does not protect data confidentiality or integrity from eavesdropping or tampering, making it unsuitable for securing remote access over untrusted public networks without additional encryption protocols.
- ✗
L2TP without encryption
Why it's wrong here
L2TP (Layer 2 Tunneling Protocol) is a tunneling protocol that encapsulates Layer 2 frames over a Layer 3 network, effectively extending a private network across the internet. However, L2TP by itself offers no native encryption or strong authentication capabilities. The explicit mention of "without encryption" in the option means that data transmitted through an L2TP tunnel would be vulnerable to interception and disclosure, failing to meet the requirement for secure communication.
- ✗
PPTP
Why it's wrong here
PPTP (Point-to-Point Tunneling Protocol) is an outdated VPN protocol that suffers from significant security vulnerabilities, rendering it unsuitable for secure communications. Its reliance on weak authentication protocols, particularly MS-CHAPv2, is susceptible to offline dictionary attacks, allowing credentials to be easily compromised. Furthermore, PPTP's underlying encryption mechanisms have known cryptographic weaknesses, making it highly vulnerable to various attacks and unable to provide adequate confidentiality or integrity for sensitive data.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
IPsec
IPsec is a suite of protocols used to secure Internet Protocol (IP) communications by encrypting and authenticating each IP packet in a data stream.
Key term
Encryption
Encryption is the process of converting readable data into a secret code to prevent unauthorized access.
About these practice questions
Courseiva writes every CISSP question from scratch — 747 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.