SSCP Network and Communications Security Practice Question

Which THREE of the following are valid considerations when deploying a remote access VPN using SSL/TLS? (Select THREE)

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Supports endpoint security posture checks

SSL/TLS VPNs use standard ports (often 443) to bypass firewalls, can perform endpoint posture checks, and allow split tunneling for performance.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Typically uses UDP port 500
Why it's wrong here
UDP port 500 is for IPsec IKE, not SSL/TLS VPNs.
✓
Supports endpoint security posture checks
Why this is correct
Many SSL VPNs can check for antivirus, updates, etc., before connecting.
✓
Can be configured for split tunneling
Why this is correct
Split tunneling allows only corporate traffic to go through the VPN.
✓
Can traverse firewalls more easily than IPsec
Why this is correct
SSL/TLS over port 443 is often allowed by firewalls, whereas IPsec may be blocked.
✗
Requires pre-shared keys for authentication
Why it's wrong here
SSL/TLS VPNs typically use certificates or other methods, not PSKs.

Quick reference

Protocol	Port	Encryption	Authentication	Use Case
IKEv2 / IPsec	UDP 500 / 4500	AES-256	Certificates / PSK	Site-to-site & remote access
SSL / TLS VPN	TCP 443	TLS 1.3	Certificates / MFA	Clientless remote access
L2TP / IPsec	UDP 1701	AES (IPsec)	PSK / Certificates	Legacy remote access
WireGuard	UDP 51820	ChaCha20	Public keys	Modern high-performance VPN
PPTP	TCP 1723	MPPE (weak)	MS-CHAPv2	Legacy — avoid in production

PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.

Go deeper