easyMultiple ChoiceObjective-mapped
CV0-004 Practice Question: A small business uses a public cloud IaaS to host…
A small business uses a public cloud IaaS to host a single Windows virtual machine (VM) running a line-of-business application. The VM has a public IP address and is in a network security group that allows RDP (port 3389) from the internet (0.0.0.0/0). The administrator frequently connects from home and various client sites. The administrator is concerned about brute force attacks on the RDP service. The business does not have a VPN server. What is the best way to secure the RDP access without changing the public IP address or blocking all external access?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.
The best because using Azure Bastion or AWS Systems Manager Session Manager eliminates public RDP exposure entirely. Instead of opening port 3389 to the internet, the administrator connects through a bastion service that authenticates and tunnels RDP over HTTPS. This prevents brute force attacks since no direct RDP port is exposed. Option B (changing port) is security through obscurity and does not stop automated scans. Option C (MFA on local accounts) is not practical without domain join and still leaves the port open. Option D (smart card certificates) still exposes the port to potential attacks on the certificate authentication process.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Remove the public IP address and use a bastion service like Azure Bastion or AWS Systems Manager Session Manager to access the VM via RDP over HTTPS.
Why this is correct
This eliminates direct public exposure of RDP and provides secure, audited access.
- ✗
Change the RDP port to a non-standard port (e.g., 3390).
Why it's wrong here
Changing the port is not a strong security control; attackers can scan for open ports.
- ✗
Enable multi-factor authentication (MFA) on the local Windows user accounts.
Why it's wrong here
MFA for local accounts is complex and the RDP port remains open to brute force.
- ✗
Disable password authentication and require smart card certificates for RDP.
Why it's wrong here
Certificate-based auth improves authentication but does not block brute force on the RDP service itself.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CV0-004 question from scratch — 977 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CV0-004 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CV0-004 exam.