mediumMultiple ChoiceObjective-mapped
SSCP Practice Question: A multinational company has a headquarters (HQ)…
A multinational company has a headquarters (HQ) and several branch offices connected via site-to-site IPsec VPN tunnels. The branch offices use a single internet connection and a VPN concentrator at HQ. Recently, users in the Asia branch report intermittent connectivity to the HQ file server, with high latency and occasional packet loss. The network team runs a traceroute from Asia branch to the HQ server; it shows the path goes through multiple hops with high latency at the second hop, which is the ISP router. The VPN tunnel status shows 'up' but with increasing rekey failures. The team has verified that the local internet link is stable and there are no bandwidth saturation issues. Which action should the team take first?
⚠ Common exam trap
The trap here is that candidates see high latency at the ISP router and immediately blame the ISP (Option D) or bandwidth (Option A), overlooking the IPsec rekey failure logs and the fact that the tunnel is 'up' but failing to rekey, which is a classic IPsec misconfiguration symptom.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Review and adjust the IPsec tunnel lifetime and rekeying thresholds.
The symptoms—intermittent connectivity, high latency at the ISP router, and increasing rekey failures with the tunnel status 'up'—point to IPsec tunnel rekeying issues. Adjusting the IPsec tunnel lifetime and rekeying thresholds (Option C) directly addresses the root cause: the tunnel is attempting to renegotiate security associations (SAs) but failing, likely due to mismatched lifetimes or network delays during rekey. This is the first logical step before escalating to the ISP or changing encryption algorithms.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Upgrade the internet bandwidth at the Asia branch.
Why it's wrong here
The link is not saturated; bandwidth increase won't fix rekey failures.
- ✗
Change the tunnel to use a different encryption algorithm like AES-256.
Why it's wrong here
Encryption strength is unlikely to cause rekey failures.
- ✓
Review and adjust the IPsec tunnel lifetime and rekeying thresholds.
Why this is correct
Rekey failures indicate mismatch or too short lifetimes.
- ✗
Contact the ISP to check for routing issues.
Why it's wrong here
The traceroute shows high latency at ISP, but the local link is stable and other branches might work fine.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SSCP question from scratch — 920 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.