SSCP Network and Communications Security Practice Question
Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)
⚠ Common exam trap
SSCP often tests whether candidates can distinguish SSL/TLS VPN characteristics from IPsec characteristics — mixing up ports (UDP 500 vs TCP 443) and authentication methods (PSK vs certificates/SAML) is the common error.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Supports endpoint security posture checks
Option B is correct because SSL/TLS VPNs (such as Cisco AnyConnect or Fortinet SSL VPN) commonly integrate host-scanning or posture-assessment modules that verify antivirus, patch level, and firewall status on the endpoint before granting access. Option C is correct because SSL/TLS VPN clients can be configured for split tunneling, allowing only traffic destined for corporate subnets to go through the tunnel while other traffic (e.g., internet browsing) goes directly out the local gateway. Option D is correct because SSL/TLS VPNs typically operate over TCP port 443 (HTTPS), which is almost universally permitted through firewalls and proxies, whereas IPsec requires UDP 500/4500 and ESP (protocol 50), which are frequently blocked. Option A is incorrect because UDP port 500 is used by IKE for IPsec, not by SSL/TLS VPNs. Option E is incorrect because SSL/TLS VPNs authenticate users via certificates, RADIUS, LDAP, or SAML, and pre-shared keys are characteristic of IPsec, not SSL/TLS VPNs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Typically uses UDP port 500
Why it's wrong here
UDP port 500 carries IKE for IPsec-based VPNs, not SSL/TLS remote access, which typically runs over TCP port 443. It is tempting because port 500 is a genuine VPN-related port, but it belongs to the IPsec/IKE negotiation channel rather than TLS-wrapped sessions.
- ✓
Supports endpoint security posture checks
Why this is correct
Many SSL/TLS VPN gateways integrate host checks, verifying patch level, antivirus state and device compliance before granting tunnel access. This satisfies the stem's deployment consideration by enforcing endpoint posture at connection time, a control IPsec remote-access deployments typically require separate tooling to achieve.
- ✓
Can be configured for split tunneling
Why this is correct
Split tunnelling lets administrators route only corporate-bound traffic through the TLS tunnel while internet traffic goes direct, conserving VPN concentrator bandwidth and latency. This satisfies the stem's deployment consideration, though it widens endpoint exposure and must be weighed against security policy.
- ✓
Can traverse firewalls more easily than IPsec
Why this is correct
SSL/TLS VPNs typically ride TCP port 443, which firewalls already permit for web traffic, so tunnels establish where IPsec's ESP and IKE ports are blocked. This satisfies the stem's deployment consideration by removing the need to open additional ports or negotiate with network teams.
- ✗
Requires pre-shared keys for authentication
Why it's wrong here
SSL/TLS remote access VPNs authenticate users through certificates, directory credentials or tokens; pre-shared keys belong to IPsec peer authentication. It is tempting because pre-shared keys are a real VPN authentication method, but they secure site-to-site IPsec tunnels rather than client TLS sessions.
Visual reference
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 971 original SSCP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official ISC2 exam blueprint
This SSCP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SSCP exam.