Secure Communication

Question 1 of 6

A traveling employee needs to connect to the corporate network from hotel Wi-Fi. The hotel blocks all non-standard outbound ports but allows outbound HTTPS. Which VPN type is MOST appropriate for this scenario?

A. Site-to-site IPsec VPN B. SSL/TLS VPN C. L2TP/IPsec VPN requiring UDP 500 D. Always-on SD-WAN tunnel

Question 2 of 6

In a site-to-site IPsec VPN, which devices act as the VPN concentrators that encrypt and decrypt tunnel traffic?

A. VPN client software on each user's laptop at both sites B. The RADIUS authentication server at the headquarters site C. The perimeter firewalls at each site D. Internet routers at each ISP point of presence

Question 3 of 6

In IPsec tunnel mode, an original IP packet from 192.168.1.10 to 10.10.1.30 is encapsulated for transmission. What does an internet router between the two VPN concentrators see as the destination IP address?

A. The IP address of the VPN concentrator at the receiving site B. 10.10.1.30 — the original internal destination C. 192.168.1.10 — the original internal source D. The IP address is encrypted and not visible in transit

Question 4 of 6

An organization has deployed SD-WAN at all branch locations to route Microsoft 365 traffic directly from each branch to Microsoft's cloud, bypassing headquarters. A security auditor flags that branch internet traffic is now leaving without inspection. Which technology directly addresses this security gap?

A. Add a site-to-site IPsec VPN from each branch back to headquarters B. Deploy SASE to inspect cloud-bound traffic at a cloud security PoP before delivery C. Replace SD-WAN with a traditional hub-and-spoke WAN so all traffic routes through headquarters D. Implement SSL/TLS VPN on all branch user devices

Question 5 of 6

Which technology replaces traditional VPN remote access by granting users identity-verified access to specific authorized applications rather than access to the entire corporate network subnet?

A. Site-to-site IPsec VPN with strong PKI authentication B. SD-WAN with intelligent traffic routing C. Always-on SSL/TLS VPN with full tunnel mode D. ZTNA (Zero Trust Network Access)

Question 6 of 6

An analyst captures an IPsec tunnel-mode packet in transit between two VPN concentrators. Which of the following correctly describes what the analyst can observe in the captured packet?

A. The original source and destination IPs, encrypted application payload B. The original source IP, original destination IP, and all application data in plaintext C. The outer IP header (concentrator-to-concentrator), IPsec header, encrypted payload, and IPsec trailer — original IPs and data are not visible D. Only the IPsec trailer — all other fields are encrypted

Matching

1. Uses TLS over TCP 443 — essentially never blocked by firewalls; supports flexible authentication (username/password, MFA, SSO) without requiring digital certificates; used for individual user remote access; can be on-demand or always-on

2. Connects two complete networks with a persistent encrypted tunnel; concentrators are the perimeter firewalls at each site; users are completely unaware — no client software on their devices; always-on and network-to-network in scope

3. Decouples WAN management from hardware; routes cloud application traffic directly from branch to cloud, eliminating headquarters backhauling; primarily a networking optimization — does not by itself provide comprehensive security for cloud-routed traffic

4. Combines SD-WAN networking with cloud-delivered security (ZTNA, SWG, CASB, FWaaS, DLP) in a unified cloud service; SASE client on every device connects to the nearest cloud PoP; provides consistent security posture regardless of user location

1. 2. 3. 4.

A. SSL/TLS VPN

B. Site-to-Site IPsec VPN

C. SD-WAN

D. SASE

Secure Communication Quiz

Matching