SSCP Network and Communications Security Practice Question
A security auditor is reviewing the configuration of a remote access VPN. Which TWO features are considered best practices for securing the VPN connection?
⚠ Common exam trap
The trap is selecting performance-oriented options (split tunneling, disabling encryption) as 'best practices'; the exam expects candidates to prioritize confidentiality and strong authentication over latency.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implementing multi-factor authentication (MFA)
Option C is correct because implementing multi-factor authentication (MFA) ensures that even if a user's credentials are compromised, an additional verification factor (such as a TOTP code or hardware token) is required before the VPN tunnel is established, directly mitigating credential-based attacks. Option E is correct because TLS 1.3 with mandatory forward secrecy (using ephemeral key exchanges like ECDHE) ensures that session keys cannot be retroactively decrypted even if the server's long-term private key is later compromised, which is a recognized best practice for protecting VPN control and data channels. Option A is not a best practice because IKEv2 with pre-shared keys only lacks per-user authentication and scalability, and PSKs are vulnerable to offline dictionary attacks; certificate-based or EAP-based authentication is preferred. Option B is incorrect because disabling encryption removes confidentiality and integrity protections, defeating the purpose of a VPN. Option D is incorrect because enabling split tunneling for all traffic can bypass corporate security controls (such as inspection and DLP) and expose the endpoint and internal network to threats, so it is not a security best practice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Using IKEv2 with pre-shared keys only
Why it's wrong here
Pre-shared keys alone are static secrets shared across peers; without certificate-based authentication or an additional factor, compromise of one key exposes the tunnel. It tempts because IKEv2 is a strong, current protocol, and PSK deployment is genuinely simple for small, fixed site-to-site links.
- ✗
Disabling encryption to reduce latency
Why it's wrong here
Disabling encryption exposes all tunnel payloads to interception and tampering, defeating the confidentiality the VPN exists to provide. It tempts because encryption overhead does add latency, so it appears to address performance concerns, but the correct practice is choosing efficient ciphers rather than removing protection.
- ✓
Implementing multi-factor authentication (MFA)
Why this is correct
Multi-factor authentication satisfies the auditor's requirement by adding a second verification factor beyond the password, defeating credential-stuffing and stolen-password attacks against the VPN gateway. Even if an attacker captures valid domain credentials, the missing second factor blocks authentication. Microsoft Entra ID Conditional Access can enforce MFA specifically for VPN sign-ins.
- ✗
Enabling split tunneling for all traffic to improve performance
Why it's wrong here
Split tunnelling routes traffic outside the encrypted tunnel, bypassing the VPN's inspection and policy controls, so it contradicts the security objective. It tempts because it genuinely reduces tunnel load and latency, and would be the right choice where performance matters more than enforcing centralised inspection.
- ✓
Using TLS 1.3 with mandatory forward secrecy
Why this is correct
TLS 1.3 with mandatory forward secrecy protects tunnel confidentiality and integrity, ensuring session keys cannot be recovered even if the server's long-term private key is later compromised. This satisfies the best-practice requirement for strong, current transport cryptography on the remote access VPN.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.