hardMultiple ChoiceObjective-mapped
220-1102 Practice Question: A technician is setting up remote access for a…
A technician is setting up remote access for a user who will be traveling internationally. The user needs to access files on a Windows server using RDP. Which additional security measure should the technician implement to protect the RDP session?
⚠ Common exam trap
CompTIA often tests the misconception that RDP's built-in encryption is sufficient for all scenarios, leading candidates to overlook the need for a VPN when the connection traverses untrusted networks, especially in international travel contexts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a VPN to encrypt all traffic before initiating RDP
B is correct because RDP traffic is encrypted but not authenticated at the transport layer, making it vulnerable to man-in-the-middle attacks, especially over untrusted international networks. A VPN (e.g., IPsec or OpenVPN) provides an additional layer of encryption and authentication for the entire session before RDP traffic is sent, ensuring confidentiality and integrity even if the RDP protocol itself is compromised.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable Network Level Authentication (NLA) on the server
Why it's wrong here
Enabling Network Level Authentication (NLA) on the server requires the client to authenticate before a full RDP session is established, preventing unauthenticated access to the login screen. While NLA significantly enhances security by mitigating denial-of-service attacks and reducing resource consumption from failed authentication attempts, it does not encrypt the data transmitted during the RDP session itself once the connection is authorized. Therefore, NLA alone does not protect the entire session from interception.
- ✓
Use a VPN to encrypt all traffic before initiating RDP
Why this is correct
Utilizing a Virtual Private Network (VPN) establishes an encrypted tunnel between the client and the remote network before any RDP traffic is sent. All data, including the RDP session, is encapsulated and encrypted within this secure tunnel, making it unreadable to unauthorized parties even if intercepted. This comprehensive encryption protects the entire RDP session from end-to-end, ensuring confidentiality and integrity against eavesdropping and tampering.
- ✗
Change the RDP port to a non-standard number
Why it's wrong here
Changing the default RDP port (3389) to a non-standard number is a form of security through obscurity, which offers minimal actual protection. While it might deter casual scanning attempts, determined attackers can easily discover the new port using port scanning tools like Nmap. This action does not add any encryption to the RDP traffic itself, leaving the session vulnerable to interception and eavesdropping once the port is identified.
- ✗
Disable clipboard redirection in the RDP session
Why it's wrong here
Disabling clipboard redirection prevents data from being copied between the local client and the remote server, thereby reducing the risk of accidental or malicious data leakage. This measure helps control the flow of sensitive information but does not contribute to the encryption or security of the RDP session's network traffic itself. The session remains vulnerable to interception if other protective measures, such as encryption, are not in place.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
Learn chapter
Windows Editions and Features
Key term
VPN
A VPN (Virtual Private Network) creates a secure, encrypted tunnel between your device and a remote server, protecting your data and hiding your online activity.
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
About these practice questions
One of 495 original 220-1202 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 220-1202 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 220-1202 exam.