Examkin

Question

Difficulty: Very hardRemote Access Technologies and Tools

A field support engineer must access the graphical user interface (GUI) of a remote Linux diagnostic server located at a branch office. The server runs a standard Virtual Network Computing (VNC) service configured to listen on its default port. Corporate security policy prohibits transmitting cleartext management traffic over the public internet and explicitly blocks inbound traffic on TCP port 5900 at the perimeter firewall. Which strategy allows the engineer to establish a secure, policy-compliant graphical session to the remote server?

  1. Configure an SSH tunnel on TCP port 22 to encrypt traffic and forward the local VNC client connection to the remote server's loopback interface.Answer
  2. B
    Reconfigure the perimeter firewall to map incoming Telnet traffic on TCP port 23 directly to TCP port 5900 on the internal Linux server.
  3. C
    Initiate a Telnet session on TCP port 23 to establish an encrypted graphical stream to the Linux server's diagnostic environment.
  4. D
    Install Remote Desktop Protocol (RDP) services on the server and connect using Windows Home edition default settings without VPN pre-authentication.

Answer

Establish an SSH tunnel over TCP port 22 to encrypt traffic and forward the local VNC viewer connection to the remote server.
Virtual Network Computing (VNC) operates by default over TCP port 5900 without native encryption. When perimeter firewalls block port 5900 and corporate policies require secure communication, technicians use Secure Shell (SSH) port forwarding over TCP port 22. The SSH connection establishes an encrypted tunnel between the client and remote host. The local VNC viewer client connects to a local port, which routes encrypted data through TCP port 22 to the remote Linux server's loopback interface on port 5900.

Step-by-Step Solution

1
Analyze protocol encryption and port security constraints.
Identified that VNC uses TCP port 5900 and transmits data unencrypted by default, which is blocked by the perimeter firewall and violates security policy.
Cleartext protocols transmitted across public networks present severe eavesdropping and credential theft risks.
2
Evaluate secure tunneling capabilities of allowed management protocols.
Selected Secure Shell (SSH) operating on TCP port 22, which provides strong public-key/symmetric encryption and port forwarding functionality.
SSH tunneling allows secondary protocol payloads (such as TCP port 5900 VNC traffic) to be safely encapsulated within an encrypted SSH transport stream.
3
Establish the remote access architecture.
Created an SSH tunnel forwarding local port traffic to localhost:5900 on the destination server, allowing the VNC viewer client to connect securely.
This configuration satisfies both firewall rules (allowing only TCP 22 inbound) and policy requirements for full encryption.

Key Concept

SSH Tunneling and VNC Remote Desktop Security
Rate this question

Topics

Remote Access Technologies and Tools

More questions from this topic