Which of the following security policies defines the use of VPN for gaining access to an internal corporate network?

Network security policy governs the overall protection and configuration of network infrastructure components and does not specifically define remote access or VPN usage procedures.

Information protection policy addresses the classification, handling, storage, and transmission of sensitive data rather than the mechanisms used to remotely connect to the corporate network.

Access control policy defines who can access which internal resources and under what conditions, but it does not specifically prescribe how remote connectivity technologies like VPN are established or used.

A remote access policy establishes who is authorized to connect remotely, which technologies (such as VPN) are approved, what authentication requirements must be met, and acceptable use conditions for remote sessions. VPN is the primary technology addressed by this policy type because it creates an encrypted tunnel between an external user and the internal corporate network. This policy directly controls the security posture of all remote connectivity to organizational resources.