A security administrator needs to deploy a remote access solution for both staff and contractors. Management favors remote desktop due to ease of use. The current risk assessment suggests protecting…

Placing an RDP server directly on the internal LAN exposes internal Windows systems to inbound remote desktop traffic, which directly contradicts the risk assessment requirement to limit direct ingress.

Moving RDP to a non-standard port is security through obscurity and provides no meaningful reduction in ingress traffic risk or protection for internal Windows hosts.

An IPSec VPN provides encrypted tunneling but virtualizing RDP without a screened subnet still routes traffic toward internal systems, failing to adequately isolate Windows hosts from direct ingress exposure.

A screened subnet (DMZ) ensures that remote users terminate their RDP sessions at a boundary-layer server rather than connecting directly to internal Windows hosts, satisfying the requirement to minimize direct ingress exposure. Two-factor authentication adds a second verification layer that protects against credential theft and unauthorized access, meeting both the management preference for RDP and the risk assessment requirement.