CISSP Communication and Network Security Practice Question
Which VPN technology operates at Layer 2 of the OSI model and is often used in combination with IPsec to provide encryption?
⚠ Common exam trap
A common misconception in the CISSP exam is that IPsec is a Layer 2 protocol when it actually operates at Layer 3. Additionally, candidates often mistakenly believe that L2TP provides encryption, but it does not—it relies on IPsec for security. Remember that L2TP is a tunneling protocol at Layer 2 and must be combined with IPsec for confidentiality.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
L2TP
L2TP (Layer 2 Tunneling Protocol) operates at Layer 2 of the OSI model, encapsulating PPP frames to create a virtual point-to-point link. It is commonly combined with IPsec (specifically ESP in tunnel mode) to provide encryption, authentication, and integrity, as L2TP itself offers no confidentiality. This combination is defined in RFC 3193 and is widely used for remote-access VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
L2TP
Why this is correct
Layer 2 Tunneling Protocol (L2TP) operates at Layer 2 (Data Link Layer) of the OSI model, encapsulating PPP frames to create a tunnel. It provides tunneling capabilities for various network protocols, effectively extending the Layer 2 network across an IP network. While L2TP itself does not provide encryption, it is commonly paired with IPsec (which operates at Layer 3) to secure the encapsulated data, forming an L2TP/IPsec VPN. This combination allows for secure, multi-protocol traffic over an IP network.
- ✗
WireGuard
Why it's wrong here
WireGuard is a modern, high-performance VPN protocol designed for simplicity and efficiency. It operates primarily at Layer 3 (Network Layer) of the OSI model, creating secure tunnels for IP packets. WireGuard encapsulates IP traffic within UDP packets, providing secure routing between endpoints. Its streamlined design and cryptographic primitives make it a fast and secure alternative to older VPN technologies, but its core function is IP packet tunneling.
- ✗
IPsec
Why it's wrong here
Internet Protocol Security (IPsec) is a suite of protocols that provides cryptographic security services at Layer 3 (Network Layer) of the OSI model. It secures IP communications by authenticating and encrypting each IP packet in a data stream. IPsec can operate in two modes: transport mode, which encrypts only the payload of the IP packet, and tunnel mode, which encrypts the entire IP packet and encapsulates it within a new IP header. This makes it fundamental for securing IP traffic, including in VPNs.
- ✗
PPTP
Why it's wrong here
Point-to-Point Tunneling Protocol (PPTP) is a legacy VPN protocol that operates at Layer 2 (Data Link Layer) of the OSI model, encapsulating PPP frames over an IP network. While it provides basic tunneling functionality, its security mechanisms, particularly its reliance on Microsoft Point-to-Point Encryption (MPPE), are considered severely weak and vulnerable to various attacks. Due to these significant security flaws, PPTP is largely deprecated and should not be used for secure communications.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Identity and Access Management (IAM)
Key term
IPsec
IPsec is a suite of protocols used to secure Internet Protocol (IP) communications by encrypting and authenticating each IP packet in a data stream.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.