hardMultiple ChoiceObjective-mapped
CISSP Practice Question: The security architect for a global financial firm
You are the security architect for a global financial firm. The organization has recently deployed a new cloud-based application that requires low-latency connections between data centers in New York, London, and Tokyo. The existing WAN uses MPLS L3 VPNs with IPsec encryption. However, the application team reports excessive latency and packet loss during peak hours. The network team confirms that the MPLS links are underutilized, but the IPsec tunnels show high CPU usage on the edge routers. Additionally, the security policy mandates that all inter-data center traffic must be encrypted and authenticated. The firm has a budget for hardware upgrades but wants to minimize operational changes. Which of the following is the BEST course of action?
⚠ Common exam trap
The trap here is that candidates mistakenly think reducing encryption strength (Option A) will solve CPU issues, but the CISSP exam tests that hardware offload is the proper solution when CPU is the bottleneck, not the algorithm choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Upgrade the edge routers to models that support hardware-accelerated IPsec encryption.
The high CPU usage on edge routers is a classic symptom of software-based IPsec encryption overwhelming the router's CPU. Hardware-accelerated IPsec offloads the cryptographic operations to dedicated ASICs or crypto engines, reducing CPU load and eliminating the latency and packet loss caused by processing bottlenecks. This directly addresses the root cause without changing the security policy or requiring major operational changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the IPsec encryption algorithm to AES-128 and the hash to SHA-1 to lower CPU usage.
Why it's wrong here
Reducing the encryption algorithm to AES-128 and the hash to SHA-1 significantly weakens the cryptographic strength of the IPsec tunnel, which is unacceptable for a global financial firm. SHA-1 is known to be cryptographically vulnerable to collision attacks, making it unsuitable for integrity and authentication in a high-security environment. This action would violate most security policies and regulatory compliance requirements, exposing sensitive data to unacceptable risks for a marginal gain in CPU performance.
- ✗
Replace MPLS with dedicated point-to-point circuits and remove IPsec encryption.
Why it's wrong here
Replacing MPLS with dedicated point-to-point circuits would drastically increase operational costs and management complexity for a global firm, negating the flexibility and cost-efficiency benefits of MPLS. More critically, removing IPsec encryption entirely would leave all data transmitted across these circuits unencrypted and vulnerable to eavesdropping and tampering. This directly violates fundamental security policies requiring data-in-transit protection, especially for a financial institution handling sensitive information.
- ✗
Increase the MTU on the WAN interfaces to reduce packet fragmentation.
Why it's wrong here
Increasing the Maximum Transmission Unit (MTU) on WAN interfaces aims to reduce packet fragmentation, which can improve network efficiency by allowing larger packets to be sent without being split. While this might slightly reduce the number of packets processed, it does not fundamentally address the root cause of high CPU usage, which is the computational overhead of cryptographic operations for IPsec encryption and decryption. The CPU still performs the same intensive cryptographic calculations per byte, regardless of packet size, thus failing to alleviate the router's processing burden.
- ✓
Upgrade the edge routers to models that support hardware-accelerated IPsec encryption.
Why this is correct
Upgrading edge routers to models equipped with hardware-accelerated IPsec encryption is the most effective solution for high CPU utilization caused by cryptographic processing. Hardware acceleration offloads the computationally intensive encryption and decryption tasks from the main CPU to specialized co-processors or ASICs. This significantly reduces the CPU load, allowing the router to handle higher volumes of encrypted traffic with lower latency and improved overall network performance, without compromising security.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
Key term
IPsec
IPsec is a suite of protocols used to secure Internet Protocol (IP) communications by encrypting and authenticating each IP packet in a data stream.
About these practice questions
One of 747 original CISSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.