220-1102 Question 162
Single answerNetwork and InternetA technician is configuring a small office router for employees who work from home several days each week. Management wants remote users to securely access internal file shares and line-of-business applications over the Internet without exposing those services directly to the public. Which solution should the technician implement?
- A
Configure port forwarding for SMB and RDP from the Internet to the internal servers
- B
Set up a VPN service on the router and require remote users to authenticate before accessing internal resources
- C
Enable UPnP so employee laptops can automatically open the ports they need from home
- D
Place the file server in a DMZ so remote users can reach it without connecting to the internal network
Show answer and explanation
Correct answer: B
Explanation
The best answer is to implement a VPN on the router for remote workers. In real-world support environments, technicians should avoid exposing internal services like SMB and RDP directly to the Internet unless there is a very specific, hardened, and tightly controlled business need. VPNs are widely recommended because they provide encrypted remote access and require user authentication before internal resources are available. This aligns with common security best practices from vendors and security guidance such as NIST recommendations to use secure remote access methods and minimize exposure of internal systems. UPnP is not a secure remote-access solution, and a DMZ is designed for isolating public-facing systems rather than granting employees protected access to private network resources.
- A. Incorrect.
Incorrect. Forwarding SMB (such as TCP 445) and RDP (such as TCP 3389) directly to internal systems exposes high-value services to the public Internet and significantly increases attack surface. While port forwarding can make a service reachable, it is not the recommended secure method for remote employee access to internal resources. This choice reflects a common mistake of confusing accessibility with secure remote access.
- B. Correct.
Correct. A VPN creates an encrypted tunnel between the remote user and the office network, allowing authenticated users to access internal resources as if they were on the local network without publishing those services directly to the Internet. This is the standard best-practice approach for remote access in small business and enterprise environments because it protects data in transit and reduces unnecessary public exposure of internal services.
- C. Incorrect.
Incorrect. UPnP can automatically open ports, but that convenience is intended for service discovery and consumer application compatibility, not for securely providing employee remote access to business resources. Enabling UPnP may actually weaken security by allowing applications to create port mappings without strict administrative control.
- D. Incorrect.
Incorrect. A DMZ is used to isolate public-facing services from the internal network, but placing an internal file server there does not solve the secure remote access requirement. It could also increase risk if sensitive internal data is hosted on a system designed to be reachable from the Internet. A DMZ is appropriate for services like public web servers, not as a replacement for authenticated remote-access VPN connectivity.