Remote municipal staff need protected access to internal systems over the Internet. Which approach best matches secure remote access architecture?
Select an answer to reveal the explanation.
Short Explanation
Remote work needs a private tunnel through the public Internet—VPN with IPsec or TLS. Do not hang RDP on the open street. Hotspot splash pages are not a confidentiality control for city systems.
Full Explanation
Remote municipal staff need confidentiality, integrity, and authentication for access to internal systems across the hostile Internet. A VPN using IPsec or TLS tunneling provides an encrypted, authenticated path into the enterprise, after which standard authorization and segmentation still apply to what the remote user may reach. That model matches Security+ secure remote-access architecture: protect the transit, then enforce least privilege inside—rather than exposing raw RDP or file shares on public addresses.
Having users expose RDP and file shares directly on public IPs without a tunnel maximizes Internet brute-force and exploit exposure against management and data protocols. Emailing passwords in cleartext weekly destroys credential confidentiality and invites interception and reuse. Relying only on a consumer free Wi-Fi hotspot login page for confidentiality confuses ISP captive portals with enterprise cryptographic protection of city traffic.
Exam caveat: remote access items favor VPN (IPsec/TLS) over direct exposure of admin/file protocols. Operationally, require MFA for VPN admission, split-tunnel only with risk acceptance, monitor VPN geolocation anomalies, push device posture checks where feasible, and deny direct inbound RDP/SMB from the Internet even for "temporary" staff exceptions.