What are typical limitations of using a VPN in modern security?

• A. VPN encrypts only email traffic; other traffic is unencrypted.
• B. VPN replaces the need for MFA in remote access.
• C. VPN guarantees zero trust and prevents lateral movement.
• D. VPN provides encrypted remote access; limitations include endpoint trust assumptions, potential for lateral movement, and not inherently zero trust.

Answer: (D)

VPNs provide encrypted remote access, but they don’t deliver zero-trust by themselves and don’t stop attackers from moving around inside a network. The encryption protects data in transit between the user’s device and the VPN gateway, but trust is still placed in the endpoint. If that device is compromised or poorly managed, an attacker can use the VPN tunnel to reach internal resources, which can enable lateral movement unless other controls—like segmentation, least-privilege access, and continuous monitoring—are in place.

Zero-trust requires ongoing verification, strict access controls, and micro-segmentation, along with device posture checks and identity-based policies. A VPN establishes a path, not these deeper protections, so it’s not inherently zero-trust and it doesn’t automatically prevent internal compromise once access is granted.

For the other ideas: VPNs don’t simply encrypt only email traffic; they tunnel traffic to the VPN gateway and typically protect broader traffic. VPNs also do not remove the need for MFA; authentication strength and device health remain important. The best-labeled statement is the one that acknowledges encrypted remote access while recognizing endpoint trust assumptions, potential for lateral movement, and the lack of inherent zero-trust.