Which of the following security policies defines the use of VPN for gaining access to an internal corporate network?

A network security policy addresses broader infrastructure protections such as firewall rules, intrusion detection, and network segmentation standards, but does not specifically govern the procedures and requirements for remote user access via VPN.

A remote access policy defines the standards and requirements for employees and authorized third parties to securely connect to an organization's internal network from external locations, directly addressing VPN configuration, authentication methods, and endpoint compliance. This policy is the authoritative document that dictates when, how, and under what conditions VPN access is permitted or restricted.

An information protection policy focuses on classifying, labeling, and safeguarding sensitive data assets from unauthorized disclosure or alteration, not on defining the technical mechanisms or conditions for remote network connectivity.

An access control policy defines authorization rules specifying which users or roles may access which resources, but does not prescribe the specific remote connectivity technologies or VPN usage procedures covered by a remote access policy.