Administrators currently expose Remote Desktop Protocol directly to the Internet. Which change best reduces that attack surface?
Select an answer to reveal the explanation.
Short Explanation
Leaving RDP on the open Internet is like leaving the town hall master key in the flowerpot. Pull it off the public face, then make admins VPN in and hop through a jump host. Changing the port number is security cosplay.
Full Explanation
Exposing Remote Desktop Protocol to the public Internet is a perennial municipal compromise path: credential attacks, unpatched RDP stacks, and automated scanners continuously probe open 3389 listeners. The durable pattern is to remove public RDP, require administrators to authenticate over a VPN (or equivalent secure remote access), and then land on a jump host or bastion that brokers management sessions into internal servers.
Publishing RDP on every public IP with a longer login banner adds warning text, not access control. Static NAT of RDP to all servers without MFA or bastion controls concentrates and amplifies exposure. Changing only the listening port obscures nothing from modern scanners and still leaves the service Internet-reachable.
Exam caveat: a jump host is an intermediate hardened system, not merely “another RDP box on the Internet.” Pair it with MFA, just-in-time access, logging, and network restrictions so management planes are not flat after VPN connect.
Operational check: scan the city’s public ranges for open RDP, revoke DNAT rules, enforce VPN-plus-bastion workflows, enable MFA on both layers where supported, and review jump-host session logs after privileged changes to confirm the intended path was used.