CISSP Communication and Network Security Practice Question
During a security assessment, a consultant discovers that a legacy VPN solution uses MS-CHAPv2 for authentication and does not support IKE. The protocol is known to be vulnerable to dictionary attacks. Which VPN protocol is most likely being used?
⚠ Common exam trap
It's easy for candidates to confuse L2TP/IPsec with PPTP because both can use MS-CHAPv2, but L2TP/IPsec requires IKE and typically uses IPsec for encryption, whereas PPTP does not support IKE and relies solely on MS-CHAPv2 for authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PPTP
MS-CHAPv2 is a Microsoft proprietary authentication protocol used by PPTP (Point-to-Point Tunneling Protocol). PPTP does not support IKE (Internet Key Exchange) and relies on MS-CHAPv2, which is vulnerable to dictionary attacks due to its weak hashing and lack of mutual authentication. The combination of MS-CHAPv2 authentication and the absence of IKE support directly points to PPTP as the VPN protocol in use.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PPTP
Why this is correct
PPTP (Point-to-Point Tunneling Protocol) is a legacy VPN protocol that relies heavily on MS-CHAPv2 for authentication. MS-CHAPv2 has well-documented cryptographic weaknesses, including susceptibility to offline dictionary attacks and specific attacks that can extract the NT password hash, compromising user credentials. Furthermore, PPTP lacks a robust key exchange mechanism like IKE, making its session key negotiation vulnerable and failing to provide forward secrecy, which is a critical security requirement for modern VPNs.
- ✗
IPsec with IKEv2
Why it's wrong here
IPsec with IKEv2 (Internet Key Exchange version 2) is a robust and widely adopted VPN solution designed for strong security. IKEv2 establishes secure Security Associations (SAs) and performs mutual authentication using strong methods such as X.509 certificates, pre-shared keys, or Extensible Authentication Protocol (EAP) which can encapsulate various methods, but not primarily MS-CHAPv2. This modern protocol provides strong encryption, integrity, and replay protection, making it highly resistant to the vulnerabilities associated with older protocols.
- ✗
SSL/TLS VPN
Why it's wrong here
SSL/TLS VPNs leverage the Transport Layer Security (TLS) protocol to create secure tunnels, offering strong encryption and authentication for remote access. Authentication in TLS VPNs typically involves server-side X.509 certificates to verify the VPN gateway's identity and often client certificates, username/password combinations, or multi-factor authentication for users. Unlike PPTP, TLS does not utilize MS-CHAPv2 as its core authentication mechanism, instead relying on more secure cryptographic primitives and established certificate-based trust models.
- ✗
L2TP/IPsec
Why it's wrong here
L2TP/IPsec combines the Layer 2 Tunneling Protocol (L2TP) for creating the tunnel with the robust security features of IPsec. IPsec provides confidentiality, integrity, and authentication for the L2TP traffic through its Encapsulating Security Payload (ESP) and Authentication Header (AH) protocols. Key exchange and secure association establishment are handled by IKE, which supports strong authentication methods like X.509 certificates or pre-shared keys, thereby avoiding the use and inherent weaknesses of MS-CHAPv2.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security assessment
A security assessment is a systematic evaluation of an organization’s systems, networks, and applications to identify vulnerabilities, threats, and risks, and to recommend improvements.
Key term
Hashing
Hashing is a one-way mathematical function that converts any input data into a fixed-length string of characters, called a hash or digest, which is used to verify data integrity and store passwords securely.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.