Administrators currently expose Remote Desktop Protocol directly to the Internet. Which change best reduces that attack surface?
Select an answer to reveal the explanation.
Short Explanation
Leaving RDP on the open Internet is like leaving the town hall master key in the flowerpot. Pull it off the public face, then make admins VPN in and hop through a jump host. Changing the port number is security cosplay.
Full Explanation
Attack surface reduction removes or constrains unnecessarily exposed services. Eliminating Internet-facing RDP and requiring VPN access through a controlled jump/bastion host shrinks opportunistic scanning and brute-force exposure. Port obfuscation alone, banner changes, or broad static NAT forwarding do not meaningfully replace controlled administrative paths. Prefer least-exposure management architectures.