Virtual Private Network (VPN)

A Virtual Private Network creates an encrypted tunnel across an untrusted network, usually the internet, so traffic travels with the confidentiality and integrity of a private link. The tunnel endpoints authenticate each other, wrap traffic in an encrypted envelope, and unwrap it at the far end; anyone on the path sees only ciphertext moving between two addresses. The heavy lifting is done by IPsec, typically ESP in tunnel mode, or by TLS-based protocols such as OpenVPN and modern clientless gateways.

Architecture is the discriminator. A site-to-site VPN joins two networks through their gateways: every host benefits, no host runs client software, and IPsec tunnel mode is the classic fit. A remote-access VPN connects one user’s device to the corporate network through client software or a browser, where TLS-based options shine because they pass through firewalls and NAT on port 443. Split tunnelling is the standing caveat: sending only corporate traffic through the tunnel improves performance but bypasses corporate inspection for everything else the device does.

Exam relevance: if a scenario connects branch offices permanently, the answer is a site-to-site IPsec VPN in tunnel mode; a travelling employee needs remote access, often TLS-based. Contrast TLS on its own, which protects a single application session; a VPN protects all traffic between its endpoints regardless of application.