Remote Access Tools Explained: RDP, Quick Assist and VNC for A+

The A+ exam expects you to know the remote access tools, what each is for, which port it uses, and the security practices around them. Microsoft Remote Assistance is one member of a family, and it has largely been replaced by Quick Assist.

The tools

Tool	Port	Use
RDP — Remote Desktop Protocol	TCP 3389	Full remote session, usually unattended
Quick Assist	HTTPS 443	Attended help; user shares their session
Remote Assistance (MSRA)	TCP 3389 / dynamic	Legacy attended help via an invitation file
VNC	TCP 5900	Cross-platform screen sharing
SSH	TCP 22	Encrypted command line
Telnet	TCP 23	Unencrypted command line — do not use
Third-party (TeamViewer, AnyDesk, Splashtop)	443	Cross-network support through firewalls

Three ports are near-certain exam content: RDP 3389, VNC 5900, SSH 22. Telnet's 23 is worth knowing so you can identify it as the wrong answer — it sends credentials in plaintext, and SSH replaces it.

Attended versus unattended

The distinction that decides which tool fits a scenario.

Attended means the user is present, sees what you do and must approve the connection. Quick Assist and Remote Assistance work this way: the user shares a code or an invitation, and both parties see the same screen. This is the right model for helping someone with a problem, and it is what consent and transparency require.

Unattended means connecting without anyone at the far end. RDP to a server is the normal case. Technically an RDP session logs the console user out on a client OS, which is why it suits servers and remote workers rather than helping a colleague at their desk.

If the question describes walking a user through a problem while they watch, the answer is Quick Assist or Remote Assistance, not RDP.

Quick Assist

The current Microsoft tool. The helper generates a code from the Quick Assist app or the Microsoft account portal; the user enters it and explicitly approves sharing. It runs over HTTPS on 443, so it traverses firewalls and NAT without configuration — the reason it replaced Remote Assistance, which needed invitation files, direct connectivity and often firewall changes.

Two practical notes that show up in troubleshooting questions. Quick Assist needs internet access and a Microsoft account for the helper. And because it works through 443 from anywhere, it is heavily abused by tech-support scammers — a point CompTIA raises under social engineering.

RDP security

Because RDP is the most attacked of these, its hardening is testable.

Never expose 3389 directly to the internet; put it behind a VPN or an RD Gateway. Require Network Level Authentication, which forces authentication before a session is established and blunts pre-auth attacks. Use multifactor authentication. Apply account lockout, since exposed RDP attracts continuous credential stuffing. Restrict who may connect through the Remote Desktop Users group rather than leaving administrators as the default. Keep it patched — RDP has had wormable vulnerabilities such as BlueKeep.

Changing the listening port is obscurity, not security, though it does reduce noise from automated scanners.

The professional and legal part

The A+ exam takes this seriously, and it is not optional in practice.

Get explicit consent before connecting to someone's machine. Tell them what you are doing as you do it. Do not open files, email or folders that are not relevant to the problem. Respect confidentiality of anything you see. Disconnect cleanly and confirm the session has ended. Document what you changed.

If you need to do something the user should not watch — entering an administrative credential — say so and blank the screen or ask them to look away, rather than doing it silently.

Troubleshooting connection failures

Work through it in order. Is the remote machine powered on and on the network? Is the service enabled — Remote Desktop is off by default on Windows? Is the firewall permitting the port? Can you resolve and reach the host by name and by IP? Are the credentials right and does that account have remote access rights? Is a gateway or VPN required from this network?

A connection that fails by name but works by IP is DNS. One that fails from outside but works inside is firewall or NAT.

What to remember

RDP is TCP 3389 and unattended; Quick Assist is attended over 443 and has superseded Remote Assistance; VNC is 5900 and cross-platform; SSH is 22 and Telnet at 23 is plaintext. Never expose RDP directly to the internet — VPN or gateway, NLA and MFA. Always get consent before connecting, and stay inside the scope of the problem.

Related reading: Port numbers to know · Vishing · Authentication factors