Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

An IT security administrator needs to implement a full-tunnel remote access VPN solution for traveling employees. The primary constraint is that these employees frequently connect from restrictive public Wi-Fi networks and hotels where firewalls block non-standard outbound ports as well as native IPsec protocols (such as IKE UDP 500/4500 and ESP). The chosen protocol must provide complete network-layer access to internal IP subnets while seamlessly encapsulating traffic over standard HTTPS. Which of the following VPN technologies best fulfills these requirements?

  1. Secure Socket Tunneling Protocol (SSTP)Answer
  2. B
    Layer 2 Tunneling Protocol over IPsec (L2TP/IPsec)
  3. C
    Clientless SSL/TLS Portal VPN
  4. D
    IPsec Authentication Header (AH) in Transport Mode

Answer

Secure Socket Tunneling Protocol (SSTP) is the optimal choice because it tunnels network traffic over TCP port 443 using SSL/TLS encryption, allowing full network access while passing through restrictive firewalls.
Secure Socket Tunneling Protocol (SSTP) transports PPP tunneling traffic over a standard SSL/TLS session using TCP port 443. Because TCP port 443 is universally enabled on firewalls for outbound HTTPS traffic, SSTP provides reliable full-tunnel network connectivity even from highly restrictive network environments.

Step-by-Step Solution

1
Analyze the technical requirements and network environment constraints.
The requirement demands full network-layer IP routing that can pass through strict firewalls blocking native IPsec protocols (IKE/ESP) and non-standard UDP ports.
Public networks and hotel firewalls frequently restrict outbound traffic to standard web ports like TCP 80 and TCP 443.
2
Evaluate candidate protocols based on OSI layer encapsulation and transport port usage.
Secure Socket Tunneling Protocol (SSTP) encapsulates PPP frames within an SSL/TLS session over TCP port 443.
Because TCP port 443 is used for secure web browsing (HTTPS), firewalls almost universally allow it.
3
Differentiate SSTP from clientless SSL/TLS access.
SSTP acts as a full-tunnel network-level client solution, unlike clientless browser portals which only proxy specific application connections.
Full network access requires tunneling Layer 3 packets across the secure transport session.

Key Concept

Secure Socket Tunneling Protocol (SSTP) Firewall Traversal
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic