A network engineer is attempting to design-in resiliency characteristics for an enterprise network's VPN services. If the engineer wants to help ensure some resilience against zero-day vulnerabilities exploited against the VPN implementation, which of the following decisions would BEST support this objective?
A) Implement a reverse proxy for VPN traffic that is defended and monitored by the organization's SOC with near-real-time alerting to administrators.
B) Subscribe to a managed service provider capable of supporting the mitigation of advanced DDoS attacks on the enterprise's pool of VPN concentrators.
C) Distribute the VPN concentrators across multiple systems at different physical sites to ensure some backup services are available in the event of primary site loss.
D) Employ a second VPN layer concurrently where the other layer's cryptographic implementation is sourced from a different vendor.

Question

Quizplus · Accepted Answer

Using a second VPN layer with a different vendor's cryptographic implementation can provide resilience against zero-day vulnerabilities, as it reduces the risk of both layers being compromised by the same vulnerability.

A Network Engineer Is Attempting to Design-In Resiliency Characteristics for an Enterprise