220-1102 Question 295
Single answerNetworkA technician is troubleshooting a Windows 11 laptop that can browse internal company websites but cannot open any external websites. The user reports this started immediately after connecting to the corporate VPN. Running ipconfig shows the laptop has a valid IP address, subnet mask, and default gateway on the local network. Other users on the same Wi-Fi can access the internet normally. Which of the following is the MOST likely cause?
- A
The VPN client is forcing all traffic through the corporate network, and the corporate VPN is not allowing internet-bound traffic
- B
The laptop has an incorrect subnet mask, preventing access to websites outside the local subnet
- C
The wireless access point is blocking outbound HTTPS traffic for this specific laptop
- D
The DNS server on the laptop is unreachable, so only internal websites can be opened
Show answer and explanation
Correct answer: A
Explanation
The best answer is that the VPN is using full-tunnel routing and sending all traffic through the corporate network. In many enterprise environments, VPN clients are configured either for split tunneling, where only corporate traffic traverses the VPN, or full tunneling, where all traffic does. If internet egress is restricted by corporate security policy or not properly configured on the VPN gateway, users may lose access to external websites while still reaching internal resources. This is a realistic support scenario for A+ Core 2 because technicians are expected to recognize how VPN settings, routing behavior, and security controls affect connectivity. This aligns with common best practices documented by VPN vendors and Microsoft networking guidance regarding split tunnel versus force-tunnel VPN configurations and their effect on client internet access.
- A. Correct.
Correct. This is a common full-tunnel VPN scenario. With full tunneling, all client traffic, including internet traffic, is sent through the corporate VPN. If the corporate VPN concentrator, firewall, or security policy does not permit internet-bound traffic, the user may still reach internal resources but fail to access external websites. The key clue is that the issue began immediately after connecting to the VPN and that internal sites remain reachable.
- B. Incorrect.
Incorrect. An incorrect subnet mask would more likely cause broader connectivity problems, such as difficulty reaching local resources or the default gateway, not a situation where internal company sites work after the VPN connects but external sites do not. Since the laptop has a valid local configuration and the timing matches VPN connection, the subnet mask is not the most likely cause.
- C. Incorrect.
Incorrect. If the access point were blocking outbound HTTPS traffic for this laptop, the issue would probably affect internet access regardless of VPN state, and other non-VPN traffic patterns would also be impacted. The scenario specifically indicates the problem started after the VPN connection was established, pointing to VPN routing or policy rather than the wireless infrastructure.
- D. Incorrect.
Incorrect. If DNS were unreachable, the user would typically have name resolution failures for both internal and external sites unless internal resources were being resolved through cached entries, hosts files, or split DNS behavior. The stronger indicator here is the VPN connection changing traffic flow. While DNS issues can cause website access problems, they are less consistent with this exact symptom pattern.