A cloud security review finds that RDP is open to the internet on every Windows VM in the customer's IaaS environment, so administrators can connect from anywhere. What is the best remediation?
Select an answer to reveal the explanation.
Short Explanation
Opening RDP on every VM to the whole internet is like giving every room in the building its own street door. A jumpbox gives you one guarded front entrance where you check ID, require MFA and record who came in. Port changes and lockouts are speed bumps, not a fix.
Full Explanation
Internet-exposed remote desktop services are among the most frequently attacked entry points. A jumpbox, also called a bastion host, is a single hardened system placed in a restricted subnet, reachable only through an approved path such as a VPN or a secure access gateway, that administrators must authenticate to, with MFA, before connecting onward to workloads. The workloads' security groups then allow RDP only from the bastion's address, eliminating direct internet exposure, and the bastion provides a central point for session recording and audit. Moving RDP to a nonstandard port is obscurity; scanners sweep every port, and the service and its vulnerabilities remain reachable by anyone. Account lockout slows password guessing but does not address protocol vulnerabilities, can be abused to lock out legitimate administrators, and leaves every VM exposed. Host antivirus is a useful layer for detecting malware after compromise, but it does not reduce the attack surface or stop an attacker who signs in with stolen credentials. Exam caveat: the outline lists RDP, SSH, secure terminal access, console access, jumpboxes, virtual clients and SSO together; the theme is centralizing and controlling administrative paths rather than exposing each host. Operational check: scan the environment from outside and confirm no VM answers on RDP, confirm the bastion enforces MFA, and verify that session logs reach the SIEM.