A security administrator needs an external vendor to correct an urgent issue with an organization's physical access control system (PACS). The PACS does not currently have internet access because it…

Temporarily granting outbound internet access to a legacy OS system directly exposes it to internet-based threats and vulnerabilities that the unpatched operating system cannot defend against, violating the principle of least exposure.

While having the vendor onsite eliminates remote access risks, it is not efficient for an urgent issue due to the time and logistics required for physical travel, failing the efficiency requirement of the scenario.

A VPN concentrator provides encrypted, authenticated remote access for the external vendor, while restricting access specifically to the PACS using desktop sharing ensures the vendor cannot access other network resources. This approach maintains the PACS's isolation from the public internet, enforces least-privilege access, and allows the administrator to monitor and terminate the session if needed - balancing both security and operational efficiency.

Using the administrator's PC as a relay for a web conference and then remotely connecting to the PACS introduces an uncontrolled, unsecured intermediary path and does not provide proper authentication, access restriction, or auditability for the external vendor's session.