SY0-701 Question 193
Single answerHigh availabilityA security administrator is redesigning a company’s remote-access environment after a recent outage prevented employees from connecting to the VPN for several hours. Management wants the new design to maintain availability if a single VPN appliance fails, without requiring users to manually change connection settings. Which solution BEST meets this requirement?
- A
Deploy two VPN concentrators in an active/passive high-availability pair with a shared virtual IP address
- B
Install a more powerful VPN concentrator with additional CPU and memory
- C
Back up the VPN concentrator configuration nightly so it can be restored quickly after a failure
- D
Place the VPN concentrator behind a stateful firewall with strict ACLs
Show answer and explanation
Correct answer: A
Explanation
The best answer is to deploy redundant VPN appliances in a high-availability configuration, typically active/passive for simplicity and predictable failover. In Security+, high availability focuses on eliminating single points of failure and ensuring critical services remain accessible during hardware or software failures. A shared or virtual IP is commonly used so clients do not need to change settings when failover occurs. By contrast, stronger hardware improves capacity, backups improve recoverability, and firewalls improve security posture, but none of those alone provide seamless service continuity. This aligns with common vendor HA designs and with security and resilience best practices such as redundancy, fault tolerance, and minimizing operational disruption.
- A. Correct.
Correct. An active/passive high-availability pair provides redundancy for the VPN service. If the primary appliance fails, the secondary appliance can take over, and a shared virtual IP address allows clients to continue using the same connection target without manual reconfiguration. This directly addresses the requirement for fault tolerance and seamless failover, which is a core high-availability design principle.
- B. Incorrect.
Incorrect. Increasing the capacity of a single VPN concentrator may improve performance, but it does not remove the single point of failure. If that appliance fails, remote access is still unavailable. This option confuses scalability and performance improvement with high availability.
- C. Incorrect.
Incorrect. Configuration backups are important for recovery and disaster recovery planning, but they do not provide immediate service continuity during a failure. Restoring a backup still takes time and typically involves downtime, so this does not satisfy the requirement to maintain availability automatically.
- D. Incorrect.
Incorrect. A stateful firewall with ACLs can improve security by controlling traffic to the VPN concentrator, but it does not by itself provide redundancy or automatic failover for the VPN service. This option addresses protection, not service availability.