SY0-501 · Question #88
An employee uses RDP to connect back to the office network. If RDP is misconfigured, which of the following security exposures would this lead to?
The correct answer is D. A man in the middle attack could occur, resulting the employee's username and password. Misconfigured RDP can expose authentication credentials to interception during transit. A man-in-the-middle (MitM) attack is the primary risk when RDP lacks proper encryption or certificate validation.
Question
An employee uses RDP to connect back to the office network. If RDP is misconfigured, which of the following security exposures would this lead to?
Options
- AA virus on the administrator's desktop would be able to sniff the administrator's username and
- BResult in an attacker being able to phish the employee's username and password.
- CA social engineering attack could occur, resulting in the employee's password being extracted.
- DA man in the middle attack could occur, resulting the employee's username and password
How the community answered
(26 responses)- A12% (3)
- B4% (1)
- C4% (1)
- D81% (21)
Why each option
Misconfigured RDP can expose authentication credentials to interception during transit. A man-in-the-middle (MitM) attack is the primary risk when RDP lacks proper encryption or certificate validation.
Sniffing from a local virus on the administrator's desktop is a local malware threat unrelated to RDP misconfiguration; it would occur regardless of how RDP is configured.
Phishing is a social-engineering attack vector that operates via deceptive emails or websites and is not a direct consequence of RDP misconfiguration.
Social engineering attacks exploit human psychology and are independent of RDP protocol configuration; a misconfigured RDP service does not inherently enable social engineering.
When RDP is misconfigured-such as using weak encryption, disabling Network Level Authentication (NLA), or failing to validate server certificates-an attacker positioned between the client and server can intercept the RDP handshake and capture credentials in a man-in-the-middle attack. This is a protocol-level vulnerability specific to RDP's transport security settings, where without proper TLS/SSL enforcement and certificate pinning, the session is susceptible to credential harvesting mid-transit.
Concept tested: RDP misconfiguration and man-in-the-middle attack risk
Source: https://learn.microsoft.com/en-us/troubleshoot/windows-server/remote/security-risks-remote-desktop-without-vpn
Topics
Community Discussion
No community discussion yet for this question.