Which is a recommended approach to secure Windows remote desktop access?

Which is a recommended approach to secure Windows remote desktop access?

• A. Use VPN or restricted network.
• B. Expose RDP directly to the Internet.
• C. Use VNC over the Internet.
• D. Leave port 3389 open and rely on passwords alone.

Answer: (C)

The main idea is to secure Windows remote desktop access by removing direct Internet exposure and using an encrypted, authenticated path into your network. A VPN creates that protected tunnel, so the remote desktop session travels inside the VPN rather than over the open Internet. This shields credentials and data from interception and stops automated Internet-scanning and brute-force attempts that target RDP. Exposing the remote desktop service directly to the Internet is risky because it becomes a visible attack surface that attackers can probe and exploit. VNC over the Internet shares a similar problem unless it’s wrapped in a secure channel (like a VPN or SSH) or otherwise protected, which adds complexity and still isn’t as robust as VPN-based access. Relying on port 3389 with passwords alone offers little protection against credential stuffing or compromise, since passwords can be weak, stolen, or reused and there’s often no additional authentication or traffic encryption. In practice, the safest approach is to require a VPN or restrict access to a managed network boundary (or use an RPC gateway/Remote Desktop Gateway with strong authentication and MFA). This keeps remote desktop traffic inside a secure, controlled path and significantly reduces the risk of unauthorized access.

The main idea is to secure Windows remote desktop access by removing direct Internet exposure and using an encrypted, authenticated path into your network. A VPN creates that protected tunnel, so the remote desktop session travels inside the VPN rather than over the open Internet. This shields credentials and data from interception and stops automated Internet-scanning and brute-force attempts that target RDP.

Exposing the remote desktop service directly to the Internet is risky because it becomes a visible attack surface that attackers can probe and exploit. VNC over the Internet shares a similar problem unless it’s wrapped in a secure channel (like a VPN or SSH) or otherwise protected, which adds complexity and still isn’t as robust as VPN-based access. Relying on port 3389 with passwords alone offers little protection against credential stuffing or compromise, since passwords can be weak, stolen, or reused and there’s often no additional authentication or traffic encryption.

In practice, the safest approach is to require a VPN or restrict access to a managed network boundary (or use an RPC gateway/Remote Desktop Gateway with strong authentication and MFA). This keeps remote desktop traffic inside a secure, controlled path and significantly reduces the risk of unauthorized access.