Examkin

Remote Access and Site-to-Site VPN Concepts

28 questions

All types28Multiple choice15Multiple select4Matching9
Question 21Question →

An organization needs to deploy a virtual private network (VPN) solution for contractors connecting from untrusted public networks using standard web browsers without requiring software installation on their endpoint devices. Additionally, corporate policy mandates that only traffic bound for internal enterprise applications should pass through the VPN tunnel, while general internet traffic routes directly out through the local internet connection. Which VPN deployment model and traffic management feature combination fulfills these security and operational requirements?

Show answer & explanation

Answer: Clientless SSL VPN combined with split tunneling

Answer

Clientless SSL VPN combined with split tunneling
Clientless SSL VPN allows users to establish secure connections using a standard web browser without installing specialized client software on host machines. Combining this with split tunneling allows traffic destined for internal corporate servers to be encrypted and routed through the VPN tunnel, while general internet traffic bypasses the tunnel to exit locally.

Step-by-Step Solution

1
Identify the VPN access mode requirement based on endpoint capabilities.
Since remote users connect via standard web browsers without dedicated software installation, Clientless SSL VPN (WebVPN) is required.
Remote Access IPsec VPNs typically require client software installation, whereas Clientless SSL VPN provides web-browser portal access.
2
Determine the appropriate traffic routing mechanism for internet versus internal traffic.
Split tunneling must be implemented.
Split tunneling selectively encrypts and routes traffic destined for corporate subnets while permitting non-corporate internet traffic to route directly out of the local network interface.

Key Concept

Remote Access SSL VPN vs IPsec VPN characteristics and Split-Tunneling operations
Question 22Question →

A financial enterprise requires a secure connection for dynamic, roaming field auditors back to corporate headquarter applications while allowing them to maintain simultaneous access to local subnet resources such as home printers. Concurrently, the organization must maintain a permanent, always-on encrypted connection between a fixed regional branch router and the headquarter security appliance to route entire subnet traffic transparently.

Which architectural combination correctly satisfies the operational requirements for both deployment models?

Show answer & explanation

Answer: Deploy a client-based Remote Access VPN using split-tunneling for the roaming auditors, and establish an IPsec Site-to-Site VPN using tunnel mode between the regional branch router and headquarter security appliance.

Answer

Deploy a client-based Remote Access VPN using split-tunneling for the roaming auditors, and establish an IPsec Site-to-Site VPN using tunnel mode between the regional branch router and headquarter security appliance.
Remote Access VPNs with split-tunneling allow individual endpoints to send corporate-bound traffic through an encrypted tunnel while accessing local network resources directly. Site-to-Site IPsec VPNs operate between fixed security gateways (routers or firewalls) using tunnel mode to securely bridge entire IP subnets over public networks.

Step-by-Step Solution

1
Analyze the requirements for the roaming field auditors.
Field auditors need access to corporate resources while retaining access to local resources (like home printers). This requires a Remote Access VPN configured with split-tunneling, which segregates corporate traffic for encryption while routing local traffic directly to the local interface.
Full-tunneling would route all traffic back through headquarters, breaking direct access to local network devices.
2
Analyze the requirements for the regional branch office connection.
The branch office requires a permanent connection between two gateway devices (router to security appliance) to pass traffic between entire subnets.
This setup defines a Site-to-Site IPsec VPN operating in tunnel mode, which encapsulates original IP packets within new outer IP headers.
3
Evaluate the combined architecture.
Pairing a Remote Access VPN with split-tunneling for mobile users and a Site-to-Site IPsec VPN in tunnel mode for gateway-to-gateway site connectivity fulfills both operational criteria without architectural conflict.
Matches standard enterprise Cisco deployment models.

Key Concept

Remote Access vs. Site-to-Site VPN Topology & Split-Tunneling Mechanics
Question 23Question →

Match each IPsec VPN framework component or feature on the left with its correct primary operational function on the right.

Click a left item, then click its matching right item

Items

Internet Key Exchange (IKE)
Encapsulating Security Payload (ESP)
Diffie-Hellman (DH) Group
NAT Traversal (NAT-T)

Matches

Show answer & explanation

Answer

Internet Key Exchange (IKE) pairs with negotiating security parameters, authenticating peers, and managing SAs. Encapsulating Security Payload (ESP) pairs with providing data confidentiality, data integrity, and origin authentication for IP payloads. Diffie-Hellman (DH) Group pairs with enabling peers to securely derive a shared symmetric encryption key over an untrusted network. NAT Traversal (NAT-T) pairs with encapsulating ESP packets inside UDP port 4500 to traverse intermediate PAT devices.
Each IPsec component fulfills a distinct cryptographic or transport requirement: IKE handles control-plane negotiations and SA creation; ESP encrypts data payload and validates integrity; Diffie-Hellman allows safe secret derivation over public IP backbones; and NAT-T wraps ESP into UDP port 4500 so port address translation devices do not drop or modify the encrypted traffic.

Step-by-Step Solution

1
Identify the control plane protocol responsible for authentication, parameter negotiation, and Security Association (SA) management.
Match Internet Key Exchange (IKE) with SA negotiation and peer authentication.
IKE (v1 or v2) is specifically responsible for establishing control channels and negotiating cryptographic sets (SAs).
2
Distinguish between data protection mechanisms and key exchange mechanisms within the IPsec suite.
Match Encapsulating Security Payload (ESP) with data encryption and integrity, and Diffie-Hellman (DH) with shared key calculation.
ESP (IP protocol 50) encrypts user data, while DH public-key exchange algorithms generate matching symmetric keys on both endpoints.
3
Determine the solution used to overcome IPsec header modification issues caused by address translation devices.
Match NAT Traversal (NAT-T) with UDP port 4500 encapsulation.
Because ESP headers lack Layer 4 port numbers required for PAT, NAT-T inserts a UDP port 4500 header in front of the ESP packet.

Key Concept

IPsec VPN Protocol Framework and NAT Traversal Operations
Question 24Question →

Match each VPN deployment scenario or operational requirement on the left with the corresponding VPN technology or protocol implementation on the right.

Click a left item, then click its matching right item

Items

Connecting two fixed corporate branch office routers across an untrusted WAN using static peer IP addresses and pre-shared keys without dynamic overlay routing.
Providing web-browser-only remote access to internal intranet web portals for external contractors without installing software on endpoint devices.
Authenticating mobile teleworkers using dedicated endpoint software to secure all IP network layer traffic with optional split-tunnel capabilities.
Establishing scalable dynamic spoke-to-spoke encrypted tunnels between multiple enterprise sites using Multipoint GRE and Next Hop Resolution Protocol.

Matches

Show answer & explanation

Answer

Static branch gateway connections match Static Site-to-Site IPsec VPN. Browser-only contractor access matches Clientless SSL VPN. Mobile endpoint client software matches Client-Based Remote Access VPN. Scalable dynamic spoke-to-spoke using mGRE/NHRP matches DMVPN.
Each requirement maps precisely to its characteristic VPN architecture: standard point-to-point router links map to Static Site-to-Site IPsec, browser-bound contractor access maps to Clientless SSL VPN, full network layer remote connectivity maps to Client-Based Remote Access VPN, and dynamic multi-site scaling with mGRE/NHRP maps to DMVPN.

Step-by-Step Solution

1
Analyze fixed gateway requirements
Connecting static branch routers with fixed peer IPs corresponds to standard Site-to-Site IPsec VPN.
Site-to-Site IPsec provides seamless, transparent network-to-network connectivity between static gateways.
2
Analyze clientless endpoint access requirements
Web portal access via web browser without endpoint software installation corresponds to Clientless SSL VPN.
Clientless SSL VPN operates via TLS within standard browsers to grant restricted access to intranet applications.
3
Analyze full network layer remote access client requirements
Dedicated endpoint software managing split-tunneling and IP layer security corresponds to Client-Based Remote Access VPN.
Client software like Cisco AnyConnect encapsulates and encrypts IP layer traffic for mobile users.
4
Analyze dynamic multi-site topology requirements
Combining mGRE, NHRP, and IPsec for dynamic direct spoke-to-spoke tunnels corresponds to DMVPN.
DMVPN simplifies hub-and-spoke and mesh topologies by dynamically resolving and establishing tunnels between spoke routers.

Key Concept

Classification and operational mechanics of Remote Access (Clientless SSL and Client-based AnyConnect) versus Site-to-Site VPN architectures (Static IPsec and DMVPN).
Question 25Question →

An enterprise needs to grant external consultants secure access to web-based internal applications from their personal, unmanaged laptops. The security policy strictly forbids requiring local administrative rights or installing persistent client software on the end-user endpoints. Which VPN deployment model best satisfies these operational constraints?

Show answer & explanation

Answer: Clientless SSL/TLS VPN accessed through a native web browser

Answer

Clientless SSL/TLS VPN accessed through a native web browser
Clientless SSL/TLS VPN allows users to securely connect to web-based internal network resources using only a standard web browser. Because the browser handles the SSL/TLS session, no administrative privileges or specialized client applications are required on the host device.

Step-by-Step Solution

1
Analyze the endpoint software and permission requirements
The scenario dictates no local admin rights and no persistent software installation on end-user devices.
Personal unmanaged endpoints cannot run managed client software installations.
2
Evaluate VPN deployment models against endpoint constraints
Clientless SSL VPN uses standard HTTPS browser connections, requiring no client installation.
Browser-based TLS sessions encapsulate application data without needing specialized local drivers or software.
3
Differentiate from Site-to-Site and Client-based IPsec alternatives
IPsec site-to-site connects gateways; IPsec remote access requires software installation.
Only Clientless SSL VPN meets both the application scope (web-based) and device policy constraints.

Key Concept

Clientless SSL VPN vs Client-based Remote Access VPN Architecture
Question 26Question →

A network security administrator is designing an IPsec site-to-site VPN to interconnect a main office and a remote branch office across the Internet. Which TWO statements correctly describe the operational functions and behavior of IPsec framework protocols in this deployment?

Select all that apply

Show answer & explanation

Answer: ESP in Tunnel mode encrypts the entire original IP packet and adds a new outer IP header for routing across public networks.; ESP provides data confidentiality, data origin authentication, and connectionless integrity for IP packets.

Answer

The two correct statements are that ESP in Tunnel mode encrypts the entire original IP packet with a new outer IP header added, and that ESP provides data confidentiality, origin authentication, and integrity.
ESP (Encapsulating Security Payload) is the core IPsec protocol used when encryption is required. In Tunnel mode, ESP encapsulates and encrypts the complete original IP packet (header and payload) with ESP headers/trailers and prepends a new outer IP header. This provides data confidentiality, authentication, and integrity across public networks.

Step-by-Step Solution

1
Evaluate the capabilities and operation of ESP (Encapsulating Security Payload).
ESP delivers encryption (confidentiality), authentication, and integrity. When configured in Tunnel mode, it protects the entire original IP packet and places a new outer IP header in front of the ESP header.
Gateway-to-gateway VPN tunnels require full packet encapsulation (Tunnel mode) and confidentiality (ESP) to safely transit public networks.
2
Examine statements regarding AH (Authentication Header) features and NAT interaction.
AH provides integrity and authentication but lacks encryption capability. Because AH hashes immutable and mutable outer IP header fields, address modifications by NAT break AH validation.
Recognizing that AH lacks confidentiality and is incompatible with NAT eliminates incorrect protocol claims.
3
Differentiate between Transport mode and Tunnel mode encapsulation.
Transport mode leaves the original IP header unencapsulated (protecting only the payload), whereas Tunnel mode creates a new outer IP header around the entire original IP packet.
This confirms Tunnel mode is the required encapsulation method for site-to-site security gateways.

Key Concept

IPsec Framework Protocols (ESP vs. AH) and Encapsulation Modes (Tunnel vs. Transport)
Question 27Question →

Match each VPN operational feature or protocol component on the left with its corresponding functional description on the right.

Click a left item, then click its matching right item

Items

Dead Peer Detection (DPD)
Split Tunneling
Authentication Header (AH)
Dynamic Multipoint VPN (DMVPN)

Matches

Show answer & explanation

Answer

Dead Peer Detection matches with monitoring tunnel liveness via keepalives; Split Tunneling matches with selectively routing corporate traffic through the tunnel while internet traffic bypasses it; Authentication Header matches with providing integrity and authentication without data encryption; Dynamic Multipoint VPN matches with leveraging GRE, NHRP, and IPsec to dynamically establish spoke-to-spoke tunnels.
Each feature corresponds to its specific technical function in VPN architecture: Dead Peer Detection detects dead VPN peers via keepalives; Split Tunneling optimizes bandwidth by routing only targeted subnets over the VPN; Authentication Header provides integrity without encryption; Dynamic Multipoint VPN uses mGRE and NHRP for dynamic spoke-to-spoke WAN connectivity.

Step-by-Step Solution

1
Analyze Dead Peer Detection (DPD)
Identify that DPD handles connection liveness monitoring using hello/keepalive messages between IPsec peers.
VPN gateways need a mechanism to reclaim security association resources when a peer unexpectedly crashes or loses power.
2
Analyze Split Tunneling
Identify that split tunneling separates corporate-bound traffic (sent inside the VPN) from general internet traffic (sent outside the VPN).
This conserves central corporate internet bandwidth while maintaining secure access to private enterprise resources.
3
Analyze Authentication Header (AH)
Identify that AH provides integrity and authentication for the whole packet, but does not provide encryption (confidentiality).
AH (IP protocol 51) computes a hashed MAC over packet headers and payload, whereas ESP (IP protocol 50) is required for encryption.
4
Analyze Dynamic Multipoint VPN (DMVPN)
Identify that DMVPN combines mGRE, NHRP, and IPsec to form on-demand site-to-site tunnels dynamically.
DMVPN scales enterprise WAN topologies by allowing spokes to communicate directly without hair-pinning traffic through the hub.

Key Concept

Remote Access and Site-to-Site VPN Components & Operation
Question 28Question →

An enterprise requires remote employees using corporate laptops to establish a secure network-layer tunnel back to the headquarters firewall. The solution must support all IP-based applications and operate seamlessly across restrictive public networks by encapsulating traffic inside TLS or DTLS on port 443. Which VPN technology should the administrator deploy to satisfy these requirements?

Show answer & explanation

Answer: SSL/TLS remote access VPN utilizing a dedicated software client

Answer

SSL/TLS remote access VPN utilizing a dedicated software client
Client-based SSL/TLS remote access VPNs (such as Cisco Secure Client / AnyConnect) create a virtual network interface on the user's endpoint, encapsulating all network-layer IP traffic inside TLS (TCP 443) or DTLS (UDP 443). This satisfies both requirements: supporting arbitrary IP applications and seamlessly bypassing restrictive firewalls.

Step-by-Step Solution

1
Analyze the access requirement
Individual remote users (teleworkers) need full network-level IP application access from their laptops to headquarters.
Remote access VPNs are designed for individual user-to-network connections, whereas site-to-site VPNs connect entire network segments.
2
Evaluate transport and protocol constraints
Traffic must be encapsulated over SSL/TLS or DTLS using port 443 to traverse restrictive firewalls.
SSL/TLS remote access VPNs use TCP/UDP port 443, which easily passes through NAT and strict firewall rules compared to native IPsec ESP (IP protocol 50).
3
Select the appropriate client deployment model
A dedicated client software (such as Cisco AnyConnect) is required for full network-layer IP encapsulation.
Clientless SSL VPN is limited to web browser access, whereas client-based SSL VPN creates a virtual network interface that tunnels all client IP traffic.

Key Concept

SSL/TLS Remote Access VPN Client-Based Architecture vs Clientless and Site-to-Site VPNs
Estimated Time:1m 15s
PreviousPage 2 / 2
Remote Access and Site-to-Site VPN Concepts Practice Questions — Cisco CCNA — Page 2 | Examkin