VPN and Remote Access
Secure remote connectivity using VPN technologies. Covers tunneling protocols including IPSec and TLS, site-to-site vs remote access VPNs, full tunnel vs split tunnel configurations, and VPN security considerations.
Understanding VPN and Remote Access
VPNs (Virtual Private Networks) create encrypted tunnels over untrusted networks, enabling secure remote access and site-to-site connectivity. Understanding VPN protocols and configurations is essential for secure remote work and branch office connectivity.
VPN use cases: • Remote access — Employees connecting from home/travel • Site-to-site — Connecting branch offices securely • Client-to-site — Individual devices to corporate network • Extranet — Secure partner/vendor connections
The COVID-19 pandemic caused VPN usage to surge 400% as organizations rapidly shifted to remote work. Many discovered their VPN infrastructure wasn't sized for universal remote access—and some suffered breaches through unpatched VPN appliances, like the 2019 Pulse Secure VPN vulnerabilities that were exploited for years.
Properly configured VPNs are essential for secure remote connectivity.
Why This Matters for the Exam
VPN and remote access security is heavily tested on SY0-701 because remote work is ubiquitous. Questions cover VPN protocols, tunneling modes, and security configurations.
Understanding VPN security helps with remote workforce security, branch connectivity, and network architecture. Misconfigured VPNs expose corporate networks.
The exam tests both protocol knowledge and practical deployment scenarios.
Deep Dive
What Is the Difference Between IPSec and TLS VPNs?
IPSec VPN:
Operates at: Network layer (Layer 3) Protects: All IP traffic Requires: Client software or hardware Use case: Site-to-site, full network access
TLS/SSL VPN:
Operates at: Transport/Application layer Protects: Specific applications/services Requires: Web browser or lightweight client Use case: Remote access, specific apps
Protocol Comparison:
| Aspect | IPSec | TLS VPN |
|---|---|---|
| Layer | Network (3) | Transport/App (4-7) |
| Client | Dedicated software | Browser/light client |
| Access | Full network | Specific apps |
| Firewall traversal | May have issues | Usually port 443 |
| Setup complexity | Higher | Lower |
| Granular control | Limited | Fine-grained |
What Are IPSec Tunnel Mode and Transport Mode?
Tunnel Mode:
Original packet: [IP Header][Data]
↓
Tunnel mode: [New IP Header][IPSec Header][Original IP Header][Data]
Encrypted
Entire original packet is encrypted
New IP header added for routing
Used for: Site-to-site VPNsTransport Mode:
Original packet: [IP Header][Data]
↓
Transport mode: [IP Header][IPSec Header][Data]
Encrypted
Only payload encrypted, original header preserved
Used for: Host-to-host communicationMode Comparison:
| Aspect | Tunnel Mode | Transport Mode |
|---|---|---|
| Encryption | Entire packet | Payload only |
| IP header | New header added | Original preserved |
| Common use | Site-to-site | Host-to-host |
| Overhead | Higher | Lower |
What Are IPSec AH and ESP?
Authentication Header (AH):
Provides: Integrity + Authentication Does NOT provide: Confidentiality (no encryption) Use: When you need to verify sender, encryption not required
Encapsulating Security Payload (ESP):
Provides: Confidentiality + Integrity + Authentication Encryption: Yes Use: Most common, provides full protection
AH vs ESP:
| Feature | AH | ESP |
|---|---|---|
| Confidentiality | No | Yes |
| Integrity | Yes | Yes |
| Authentication | Yes | Yes |
| Protocol number | 51 | 50 |
| Common usage | Rare | Standard |
Most VPNs use ESP because encryption (confidentiality) is typically required.
What Is the Difference Between Site-to-Site and Remote Access VPN?
Site-to-Site VPN:
Remote Access VPN:
Comparison:
| Aspect | Site-to-Site | Remote Access |
|---|---|---|
| Endpoints | Network to Network | Device to Network |
| Connection | Permanent | On-demand |
| Users | Transparent | Must connect |
| Common protocol | IPSec | IPSec or TLS |
What Is Full Tunnel vs Split Tunnel?
Full Tunnel:
Split Tunnel:
Security Comparison:
| Aspect | Full Tunnel | Split Tunnel |
|---|---|---|
| Security | Higher | Lower |
| Performance | Slower | Faster |
| Bandwidth usage | Higher | Lower |
| Policy enforcement | Complete | Partial |
| Corporate visibility | All traffic | Only corporate |
What VPN Security Considerations Exist?
VPN Security Best Practices:
| Practice | Purpose |
|---|---|
| Strong authentication | MFA for VPN access |
| Certificate-based auth | Stronger than passwords |
| Endpoint compliance | NAC for VPN clients |
| Session timeouts | Limit idle connections |
| Split tunnel policy | Balance security/performance |
| VPN appliance patching | Critical vulnerabilities |
VPN Vulnerabilities:
- •Unpatched VPN appliances
- •Weak authentication
- •Credential theft (phishing)
- •Split tunnel data exposure
- •Session hijacking
How CompTIA Tests This
Example Analysis
Scenario: A company needs to connect their headquarters to a new branch office. They require all traffic between sites to be encrypted, and the connection should be always-on without user intervention. Additionally, remote employees need to access corporate resources from home.
Analysis - VPN Solution Design:
Requirements:
| Requirement | Solution |
|---|---|
| HQ to branch encrypted | Site-to-site VPN |
| Always-on, transparent | IPSec tunnel mode |
| Remote employee access | Remote access VPN |
| Strong authentication | Certificates + MFA |
Site-to-Site Solution:
Remote Access Solution:
Why These Choices:
| Decision | Reason |
|---|---|
| IPSec for site-to-site | Full network connectivity, always-on |
| Tunnel mode | Encrypts entire packets, new IP header |
| ESP (not AH) | Need encryption, not just authentication |
| TLS for remote | Firewall-friendly (port 443), easier client |
| Full tunnel | Security policy enforcement for remote |
| MFA | Protect against credential theft |
Key insight: Site-to-site VPNs use IPSec tunnel mode for transparent, always-on connectivity. Remote access VPNs typically use TLS for easier deployment and firewall traversal. Both need strong authentication.
Key Terms
Common Mistakes
Exam Tips
Memory Trick
IPSec Modes:
Tunnel mode = "Totally encrypted, new header on Top" Entire original packet encrypted, new IP header added Think: A tunnel completely covers the road
Transport mode = "Transporting only the Package" Only payload encrypted, original header stays Think: Transport truck, cargo covered but truck visible
ESP vs AH:
ESP = Encrypts Stuff Properly Confidentiality + Integrity + Authentication
AH = Authentication Header (no encryption) Only integrity/authentication, NO confidentiality
"AH is A Half solution—no encryption"
VPN Types: "Site-to-Site = Switch to Switch" Routers/networks connected, always on
"Remote Access = Remote Anyone connecting" Individual users, on-demand
Full vs Split Tunnel: "Full = ALL traffic through the Firewall (corporate)" "Split = Some goes Public, some Local, some through Internal Tunnel"
Test Your Knowledge
Q1.A company needs to connect two office networks with an always-on encrypted connection where users are unaware of the VPN. What is the BEST solution?
Q2.Which IPSec component provides encryption (confidentiality)?
Q3.What is the security concern with split tunnel VPN configuration?
Want more practice with instant AI feedback?
Continue Learning
Ready for the Exam?
See exactly where you stand on this concept and 182 others.
99% pass rate · Pass guarantee