N10-009 Question 239
Single answerSite-to-site VPN, Client-to-site VPN, Clientless, Split tunnel vs. full tunnelA company has a headquarters office and a branch office that need constant encrypted connectivity between their internal LANs so file servers, VoIP phones, and printers work across both locations without users launching a VPN client. The company also has traveling employees who occasionally need secure access to a single internal web-based timesheet from unmanaged hotel business-center PCs, but the security team does not want to install software on those public systems or expose the rest of the internal network. Which solution best meets both requirements?
- A
Deploy a site-to-site VPN between the two offices and provide a clientless SSL VPN portal for traveling employees to access only the timesheet application
- B
Deploy a client-to-site VPN for the branch office users and require traveling employees to use split tunneling from public PCs
- C
Deploy a full-tunnel client-to-site VPN for all users, including the branch office, and allow browser access to any internal resource after login
- D
Deploy a site-to-site VPN between the offices and require traveling employees to use a traditional client-to-site VPN installed on the hotel business-center PCs
Show answer and explanation
Correct answer: A
Explanation
This scenario requires matching VPN types to different business needs. For office-to-office connectivity, best practice is a site-to-site VPN because it connects networks through edge devices and provides seamless access for users and services such as printers, file shares, and VoIP without requiring a VPN client on each workstation. For occasional access from unmanaged public computers, a clientless VPN is the best fit because it commonly provides browser-based access to specific applications, often via SSL/TLS, without installing client software. This also supports the principle of least privilege by limiting access to only the web-based timesheet instead of exposing the full internal network.
A client-to-site VPN is typically used for individual users on managed laptops or mobile devices. Split tunnel versus full tunnel is an important design choice in client-to-site deployments: split tunneling sends only corporate-bound traffic through the VPN while other traffic goes directly to the internet, improving bandwidth use but potentially increasing risk; full tunneling sends all traffic through the VPN, improving centralized inspection and policy enforcement at the cost of more bandwidth and potential latency. In this scenario, neither split nor full tunnel changes the fact that unmanaged public PCs should not require installed VPN clients and should not receive broad network access.
These distinctions align with common enterprise remote-access and branch-connectivity practices reflected in Network+ objectives and widely used vendor guidance for IPsec site-to-site VPNs, SSL/TLS-based remote access portals, and least-privilege access design.
- A. Correct.
Correct. A site-to-site VPN is designed to connect two networks persistently through VPN gateways, which is appropriate when entire offices need transparent connectivity without end users starting VPN software. A clientless SSL VPN portal is also appropriate for unmanaged public computers because it typically uses a web browser to provide limited access to specific internal web applications, reducing the need to install a VPN client and limiting exposure of the broader network.
- B. Incorrect.
Incorrect. A client-to-site VPN is intended for individual remote endpoints, not for providing transparent, always-on connectivity between two office LANs. Also, split tunneling on public PCs is not the best fit here because the requirement is to avoid installing software and to provide access only to one internal web application. Split tunneling would also leave the public PC simultaneously connected to the internet and the corporate network, which is generally a poor choice for unmanaged systems.
- C. Incorrect.
Incorrect. A full-tunnel client-to-site VPN can be appropriate for managed remote devices when all traffic should pass through the corporate network, but it is not the best design for connecting an entire branch office where users should not need to launch clients individually. The statement about allowing browser access to any internal resource is also overly broad and conflicts with the requirement to restrict traveling employees to only the timesheet application.
- D. Incorrect.
Incorrect. The site-to-site VPN portion fits the branch office requirement, but requiring a traditional client-to-site VPN on hotel business-center PCs violates the requirement to avoid software installation on unmanaged public systems. It also provides broader network-level access than necessary when the need is limited to a single web-based application.