ISC2 Systems Security Certified Practitioner (SSCP) Practice Question

Publishing the application through a server-hosted virtual desktop infrastructure (VDI) that is front-ended by an HTML5-enabled secure reverse proxy placed in the DMZ satisfies all stated requirements. The desktops run inside the protected network, so data never leaves the data center and cannot be copied to contractor machines; only display updates and keystrokes traverse the connection. Because the reverse proxy terminates external TLS sessions in the DMZ and the VDI connection brokers initiate outbound connections to that proxy, no new inbound ports need to be opened into the internal network.

By contrast, a clientless SSL VPN portal would still require the firewall to listen for inbound HTTPS from the Internet; an IPsec site-to-site VPN demands opening UDP 500/4500 and ESP/AH; and exposing Remote Desktop Protocol (RDP) directly over TCP 3389 violates the policy and increases data-leakage risk through drive or clipboard redirection.