Which of the following statements pertaining to PPTP (Point-to-Point Tunneling Protocol) is NOT true?

A.
PPTP allows the tunneling of any protocols that can be carried within PPP.

B.
PPTP does not provide strong encryption.

C.
PPTP does not support any token-based authentication method for users.

D.
PPTP is derived from L2TP.

Explanation:
PPTP is an encapsulation protocol based on PPP that works at OSI layer 2 (Data Link) and that enables a
single point-to-point connection, usually between a client and a server. While PPTP depends on IP to establish
its connection. As currently implemented, PPTP encapsulates PPP packets using a modified version of the
generic routing encapsulation (GRE) protocol, which gives PPTP to the flexibility of handling protocols other
than IP, such as IPX and NETBEUI over IP networks. PPTP does have some limitations: It does not provide
strong encryption for protecting data, nor does it support any token-based methods for authenticating users.
L2TP is derived from L2F and PPTP, not the opposite.
Incorrect Answers:
A: PPTP relies on the Point-to-Point Protocol (PPP) being tunneled to implement security functionality.
B: PPTP uses PPP for encryption. The PPP protocol has only the capability to encrypt data with 128-bit so it
ensures low security.
C: The PPTP specification does not include authentication. In the Microsoft implementation, the tunneled PPP
traffic can be authenticated with PAP, CHAP, MS-CHAP v1/v2 , but not with any token-based authentication
scheme.

Harris, Shon, All In One CISSP Exam Guide, 6th Edition, McGraw-Hill, New York, 2013, p. 708