CISSP Practice Question: Which TWO of the following are characteristics of…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Provides confidentiality

  Why this is correct

  A core characteristic of a VPN, particularly those utilizing protocols like TLS (Transport Layer Security) or IPsec, is the establishment of a secure, encrypted tunnel. This encryption process, often employing strong cryptographic algorithms such as AES (Advanced Encryption Standard), transforms the data into an unreadable format. This ensures that even if the data is intercepted during transit across an untrusted network, its content remains confidential and inaccessible to unauthorized parties.

• ✗

  Requires a digital certificate on the server

  Why it's wrong here

  While digital certificates, particularly X.509 certificates, are a very common and robust method for server authentication in VPNs using TLS or IPsec (especially in enterprise environments), they are not an absolute requirement. VPNs can also establish secure connections using alternative authentication mechanisms, such as pre-shared keys (PSKs) or username/password combinations, particularly in smaller deployments or specific IPsec configurations. Therefore, stating that a digital certificate is strictly required is an overgeneralization.

• ✓

  Provides integrity

  Why this is correct

  Data integrity is a fundamental security service provided by VPNs, ensuring that transmitted data has not been altered or tampered with during transit. Protocols like TLS and IPsec achieve this by employing Message Authentication Codes (MACs) or cryptographic hash functions (e.g., HMAC-SHA256). These mechanisms generate a unique checksum for each data packet, which is then verified upon receipt. Any discrepancy between the calculated and received checksum indicates unauthorized modification, leading to the rejection of the compromised data.

• ✗

  Operates at the network layer

  Why it's wrong here

  While some VPN protocols, such as IPsec in tunnel mode, primarily operate at the network layer (OSI Layer 3) by encapsulating entire IP packets, the question refers to characteristics of a VPN generally, and TLS is a common VPN component. TLS (Transport Layer Security), a widely used protocol for securing VPN connections (e.g., SSL/TLS VPNs), fundamentally operates at the transport layer (OSI Layer 4). It sits above TCP and below application protocols, securing the end-to-end communication stream rather than the network routing.

• ✗

  Typically uses UDP port 500

  Why it's wrong here

  UDP port 500 is specifically associated with the Internet Key Exchange (IKE) protocol, which is a crucial component for establishing security associations in IPsec VPNs. IKE is responsible for negotiating and managing the cryptographic keys and security parameters used by IPsec. However, this port is not typically used by TLS-based VPNs, which often utilize TCP port 443 (for HTTPS-based VPNs) or other application-specific ports. Therefore, this statement is accurate for IPsec but not a general characteristic for all VPNs.

Go deeper

Related to this question