Remote inspectors use external WLANs and VPN back to county systems. Leadership asks about split-tunnel versus full-tunnel. What is the key security-architecture distinction?
Select an answer to reveal the explanation.
Short Explanation
Full tunnel hauls everything through the city VPN; split tunnel lets some traffic skip that path. The words on the SSID do not make them the same. Bluetooth keyboards are not the model.
Full Explanation
For remote inspectors on external WLANs using VPN back to county systems, the key security-architecture distinction is that full tunnel sends all client traffic through the municipal VPN path while split tunnel exempts some destinations from that path. Full tunnel maximizes centralized inspection and reduces leakage onto the local café network; split tunnel can improve performance for general Internet destinations but leaves those flows outside municipal VPN controls. Leadership should explicitly name which traffic classes, if any, may bypass the tunnel for field staff. Split tunnel does not always encrypt café DNS better than IPsec full tunnel; often DNS or web traffic escaping locally increases exposure. Split and full tunnel are not identical merely because the SSID name contains the word “secure.” Full tunnel is not a Bluetooth-keyboard-only concept unrelated to Wi-Fi clients used by inspectors. Exam caveat: split-tunnel exceptions marketed as “only SaaS” must be validated so case-management or evidence-upload apps do not accidentally bypass required inspection and logging. Operational check: with a test inspector laptop, enable full tunnel and confirm all flows egress via the VPN concentrator; then enable the proposed split profile and capture which destinations leave locally versus through the tunnel before approving the remote-access standard.