N10-009 Question 240
Single answerSite-to-site VPN, Client-to-site VPN, Clientless, Split tunnel vs. full tunnelA company has a headquarters office and a branch office that both need постоянный, encrypted connectivity between their internal networks so file shares and printers are available without users manually starting VPN software. The same company also has traveling employees who use laptops from hotels and airports, and those users must securely access internal applications. Security policy requires that when remote users connect, all of their internet traffic must be inspected by the company's web filtering tools before reaching the internet. Which solution best meets these requirements?
- A
Deploy a site-to-site VPN between headquarters and the branch office, and use a client-to-site VPN with full tunneling for traveling employees
- B
Deploy a clientless VPN between headquarters and the branch office, and use split tunneling for traveling employees
- C
Deploy a client-to-site VPN between headquarters and the branch office, and use a clientless VPN with split tunneling for traveling employees
- D
Deploy a site-to-site VPN between headquarters and the branch office, and use split tunneling for traveling employees so internal traffic is encrypted while internet traffic goes out locally
Show answer and explanation
Correct answer: A
Explanation
This scenario requires matching each use case to the correct VPN type and tunneling mode. Site-to-site VPNs are used to connect two networks, such as headquarters and a branch office, and are commonly implemented on firewalls or VPN gateways so users do not need to initiate sessions manually. Client-to-site VPNs, also called remote-access VPNs, are intended for individual users connecting from external locations. Clientless VPNs usually provide access through a web browser and are best suited for specific web resources rather than broad network access. For traffic handling, full tunneling sends all remote-client traffic through the VPN concentrator or firewall, enabling centralized monitoring, filtering, and policy enforcement. Split tunneling only routes traffic for corporate destinations through the VPN and sends other traffic directly to the internet, which reduces bandwidth usage but weakens centralized inspection and can increase risk. These distinctions align with common Network+ objectives and standard vendor documentation from firewall and VPN providers that differentiate site-to-site vs. remote-access deployments and split-tunnel vs. full-tunnel behavior.
- A. Correct.
Correct. A site-to-site VPN is designed for persistent network-to-network connectivity between two locations, allowing users at each office to access resources without launching individual VPN clients. For traveling employees, a client-to-site (remote-access) VPN is the appropriate choice because individual users connect securely from untrusted networks. Full tunneling sends all client traffic, including internet-bound traffic, through the corporate VPN so it can be filtered and inspected by company security tools, which matches the stated policy.
- B. Incorrect.
Incorrect. A clientless VPN is typically browser-based and intended for limited remote access to specific web applications, not for permanently linking two office networks. Split tunneling would also violate the requirement that all remote-user internet traffic be inspected by corporate web filtering tools, because internet traffic would bypass the company network.
- C. Incorrect.
Incorrect. Using client-to-site VPNs between entire offices is not the standard design for continuous branch-to-headquarters connectivity; that is what site-to-site VPNs are for. In addition, a clientless VPN is usually limited to web-based access and would not be appropriate for general laptop-based remote access to internal applications that may require broader network connectivity. Split tunneling again fails the requirement for centralized inspection of all user internet traffic.
- D. Incorrect.
Incorrect. The site-to-site portion is appropriate for office-to-office connectivity, but split tunneling is the wrong choice for remote users when the business requires all traffic to pass through corporate security controls. With split tunneling, only traffic destined for internal networks traverses the VPN, while general internet traffic exits directly from the user's local connection.