220-1202 Practice Question: A small business owner wants to allow a remote…

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable port forwarding on the router for TCP 3389 to the desktop's IP address.

  Why it's wrong here

  This method directly exposes the Remote Desktop Protocol (RDP) service on TCP port 3389 to the public internet. Attackers constantly scan for open RDP ports, making the desktop highly susceptible to automated brute-force attacks, credential stuffing, and exploits targeting RDP vulnerabilities. This significantly increases the risk of unauthorized access and potential compromise of the entire office network.

• ✓

  Configure a VPN server on the office network and have the employee connect via VPN before using RDP.

  Why this is correct

  Configuring a Virtual Private Network (VPN) server establishes an encrypted tunnel between the remote employee's device and the office network. This requires the employee to authenticate to the VPN server first, effectively placing their device *inside* the office network virtually. Only then can RDP traffic traverse the secure, authenticated tunnel, preventing direct exposure of RDP to the public internet and significantly enhancing security.

• ✗

  Use a third-party remote desktop service like TeamViewer without additional configuration.

  Why it's wrong here

  Relying solely on a third-party remote desktop service like TeamViewer introduces dependency on an external provider's security infrastructure and policies. While convenient, the business owner loses direct control over the data's transit path and security configurations, potentially exposing sensitive information to the third-party's servers. This approach might not meet specific compliance requirements and could introduce unforeseen vulnerabilities if the service itself is compromised.

• ✗

  Change the RDP port to a non-standard port number and enable port forwarding.

  Why it's wrong here

  Changing the default RDP port from 3389 to a non-standard number, often referred to as "security by obscurity," offers minimal actual security. While it might deter basic automated port scans looking specifically for 3389, a determined attacker will still perform a full port scan of the target IP address, easily discovering the custom RDP port. The service remains directly exposed to the internet, vulnerable to the same brute-force and exploit attempts as if it were on the default port.

Go deeper

Related to this question