Examkin

Question

Difficulty: HardRemote Access and Site-to-Site VPN Concepts

A financial enterprise requires a secure connection for dynamic, roaming field auditors back to corporate headquarter applications while allowing them to maintain simultaneous access to local subnet resources such as home printers. Concurrently, the organization must maintain a permanent, always-on encrypted connection between a fixed regional branch router and the headquarter security appliance to route entire subnet traffic transparently.

Which architectural combination correctly satisfies the operational requirements for both deployment models?

  1. Deploy a client-based Remote Access VPN using split-tunneling for the roaming auditors, and establish an IPsec Site-to-Site VPN using tunnel mode between the regional branch router and headquarter security appliance.Answer
  2. B
    Deploy a full-tunneling Remote Access VPN for the roaming auditors to preserve local subnet printing, and configure a clientless SSL VPN on the regional branch gateway for the site-to-site connection.
  3. C
    Deploy TACACS+ payload encryption across a Site-to-Site VPN for roaming auditors, and configure a clientless RADIUS tunnel for the branch router connection.
  4. D
    Deploy an IPsec Site-to-Site VPN operating in transport mode directly on the roaming auditor laptops, while configuring a split-tunneling profile on the regional branch router to connect the two sites.

Answer

Deploy a client-based Remote Access VPN using split-tunneling for the roaming auditors, and establish an IPsec Site-to-Site VPN using tunnel mode between the regional branch router and headquarter security appliance.
Remote Access VPNs with split-tunneling allow individual endpoints to send corporate-bound traffic through an encrypted tunnel while accessing local network resources directly. Site-to-Site IPsec VPNs operate between fixed security gateways (routers or firewalls) using tunnel mode to securely bridge entire IP subnets over public networks.

Step-by-Step Solution

1
Analyze the requirements for the roaming field auditors.
Field auditors need access to corporate resources while retaining access to local resources (like home printers). This requires a Remote Access VPN configured with split-tunneling, which segregates corporate traffic for encryption while routing local traffic directly to the local interface.
Full-tunneling would route all traffic back through headquarters, breaking direct access to local network devices.
2
Analyze the requirements for the regional branch office connection.
The branch office requires a permanent connection between two gateway devices (router to security appliance) to pass traffic between entire subnets.
This setup defines a Site-to-Site IPsec VPN operating in tunnel mode, which encapsulates original IP packets within new outer IP headers.
3
Evaluate the combined architecture.
Pairing a Remote Access VPN with split-tunneling for mobile users and a Site-to-Site IPsec VPN in tunnel mode for gateway-to-gateway site connectivity fulfills both operational criteria without architectural conflict.
Matches standard enterprise Cisco deployment models.

Key Concept

Remote Access vs. Site-to-Site VPN Topology & Split-Tunneling Mechanics
Rate this question

Topics

Remote Access and Site-to-Site VPN Concepts

More questions from this topic