220-1102 Question 424
Single answerSoftware firewallsA small business uses Windows 11 laptops for remote work. After a recent security hardening change, several users report that they can connect to the company VPN, but they can no longer use Remote Desktop to reach their office PCs. The VPN client shows as connected, and users can ping the office PCs by IP address. As the technician, you verify that Remote Desktop is enabled on the office PCs and that the VPN tunnel is working. Which action is the MOST likely to restore Remote Desktop access while maintaining good security practice?
- A
Disable Windows Defender Firewall on the users' laptops while they are connected to the VPN
- B
Create or enable a Windows Defender Firewall rule that allows Remote Desktop traffic on the appropriate network profile
- C
Open all inbound and outbound ports on the users' laptops so the VPN can pass Remote Desktop traffic
- D
Reinstall the VPN client because software firewalls block all encrypted traffic by default
Show answer and explanation
Correct answer: B
Explanation
This scenario tests practical troubleshooting of software firewalls on Windows systems. Because the VPN connection is established and users can ping office PCs, basic network connectivity exists. The failure is specific to Remote Desktop, making a host-based firewall rule the most likely cause, especially after a security hardening change. In Windows Defender Firewall, rules can be enabled or disabled by network profile, and Remote Desktop traffic is typically controlled through predefined rules for TCP 3389. The best practice is to allow only the required service or application on the correct profile rather than disabling the firewall or opening unnecessary ports. This aligns with Microsoft's guidance for Windows Defender Firewall: use profile-aware, least-privilege rules and avoid disabling the firewall except for narrowly scoped testing.
- A. Incorrect.
This is incorrect because disabling the software firewall is not a good security practice and is broader than necessary. In this scenario, the VPN is already connected and ICMP traffic works, which suggests connectivity exists. The issue is more likely that the firewall is blocking Remote Desktop traffic under the current profile rather than the firewall needing to be turned off entirely.
- B. Correct.
This is correct because Windows Defender Firewall commonly uses profile-based rules (Domain, Private, Public). If a recent hardening change disabled or restricted the Remote Desktop rule, users may be able to connect to the VPN and ping hosts but still be blocked from using RDP, which uses TCP port 3389 by default. Enabling or creating the proper firewall rule for Remote Desktop on the appropriate profile restores access while following least-privilege security practice.
- C. Incorrect.
This is incorrect because opening all inbound and outbound ports is excessive and insecure. Remote Desktop requires specific traffic, not unrestricted network access. A+ best practice is to permit only the necessary application or port through the software firewall rather than broadly weakening host protections.
- D. Incorrect.
This is incorrect because software firewalls do not block all encrypted traffic by default, and the evidence shows the VPN tunnel is already functioning. Since users can connect to the VPN and ping internal systems, the VPN client is likely working. The problem is more consistent with a host firewall rule affecting Remote Desktop traffic.