📝 VPN Virtual Private Network explained (12 MCQs)
📖 From Data Communication and Networks • 32. Internet Security • 12 questions available
What is VPN Virtual Private Network explained?
A Virtual Private Network creates a secure, encrypted tunnel over a public network like the internet, allowing remote users or branch offices to safely access private network resources as if they were directly connected locally.
📝 All VPN Virtual Private Network explained MCQs
Q1. What does VPN stand for?
📖 Explanation: VPN stands for Virtual Private Network, a technology that creates an encrypted tunnel over a public network, allowing remote users or sites to communicate as if they were on a private LAN. The abbreviation directly reflects the three words in the definition, making option A the correct choice.
Q2. When a company forces all employee internet traffic through a VPN gateway, which of the following outcomes most directly enhances data confidentiality?
📖 Explanation: Routing all traffic through a VPN causes each packet to be encapsulated and encrypted before leaving the corporate network. This encryption, typically using algorithms such as , prevents eavesdroppers from reading the data, directly improving confidentiality. The other options relate to performance or network design, not confidentiality.
Q3. A VPN client uses NAT traversal to connect through a firewall that performs address translation. Which statement best captures the security implication of this arrangement?
📖 Explanation: NAT traversal allows VPN packets to pass through a NAT device, but the intermediate translation can reveal open ports and make the client susceptible to port‑scanning or replay attacks. While encryption still protects payload confidentiality, the traversal step can add exposure, making option C the most accurate.
Q4. If split tunneling is enabled on a VPN, what is the most likely risk for corporate data?
📖 Explanation: Split tunneling sends only corporate traffic through the VPN while other traffic goes directly to the internet. This creates a pathway where sensitive corporate data could be exposed to unsecured networks, leading to potential leakage. The other options describe performance benefits, not security risks.
Q5. Compare site‑to‑site VPN and remote‑access VPN. Which characteristic most clearly differentiates their scalability?
📖 Explanation: Site‑to‑site VPNs link entire networks and typically support a fixed number of gateway pairs, whereas remote‑access VPNs must accommodate many individual users connecting from diverse locations. Thus, the number of simultaneous remote users is the primary factor influencing scalability, making option A correct.
Q6. Evaluating performance, how does using AES‑256 within a VPN tunnel generally compare to AES‑128 in terms of CPU overhead?
📖 Explanation: AES‑256 uses a larger key size and more rounds than AES‑128, which translates to additional CPU cycles per block. Even with hardware acceleration, the overhead is typically higher for AES‑256, resulting in greater processing time and power consumption. Therefore, option C accurately reflects the performance impact.
Q7. Differentiate IPSec tunnel mode from transport mode. Which statement accurately describes tunnel mode?
📖 Explanation: In IPSec tunnel mode, the entire original IP packet—including its header and payload—is encrypted and encapsulated within a new IP header. This provides protection for both the data and the original routing information, distinguishing it from transport mode, which encrypts only the payload. Hence, option C is correct.
Q8. Applying perfect forward secrecy (PFS) in a VPN, which protocol inherently provides PFS?
📖 Explanation: IKEv2 negotiates a Diffie‑Hellman key exchange during the establishment of the VPN tunnel, generating a fresh session key for each connection. This ensures that compromise of a long‑term key does not reveal past session keys, fulfilling the definition of perfect forward secrecy. The other protocols lack built‑in mechanisms for PFS.
Q9. If a VPN implementation adds mandatory two‑factor authentication, which attack vector is most significantly mitigated?
📖 Explanation: Two‑factor authentication requires something the user knows and something they possess, making it much harder for attackers to reuse stolen passwords in credential‑stuffing attacks. While the VPN still encrypts traffic, man‑in‑the‑middle, DNS poisoning, and traffic analysis rely on different weaknesses, so option A is the most directly mitigated.
Q10. A VPN uses a 2048‑bit RSA key exchange. Approximately how many bits of security does this provide?
📖 Explanation: A 2048‑bit RSA key is estimated to provide roughly 112 bits of computational security, meaning an attacker would need about operations to break it. This aligns with current cryptographic guidance, making option B the most accurate estimate.
Q11. When a VPN connection drops unexpectedly, which of the following effects most directly causes a DNS leak?
📖 Explanation: If the VPN tunnel disappears, the operating system typically reverts to the network interface's default DNS resolver, often a public DNS server. This fallback can expose DNS queries that were previously protected by the VPN, creating a leak. The other options describe different behaviors unrelated to the immediate leak.
Q12. Evaluating OpenVPN versus WireGuard for mobile devices, which trade‑off best describes WireGuard's advantage?
📖 Explanation: WireGuard's codebase is intentionally minimal—around 4,000 lines of C—allowing it to run efficiently on constrained hardware. This simplicity reduces CPU cycles and power draw, extending battery life on mobile devices. OpenVPN's larger codebase and feature set can increase resource usage, making option B the correct description.