Which of the following would be of MOST concern to an IS auditor reviewing a virtual private network (VPN)
implementation? Computers on the network that are located:

A.
on the enterprise’s internal network.

B.
at the backup site.

C.
in employees’ homes.

D.
at the enterprise’s remote offices.

Explanation:
One risk of a virtual private network (VPN) implementation is the chance of allowing high-risk computers onto
the enterprise’s network. All machines that are allowed onto the virtual network should be subject to the same
security policy. Home computers are least subject to the corporate security policies, and therefore are high-risk
computers. Once a computer is hacked and ‘owned/ any network that trusts that computer is at risk.
Implementation and adherence to corporate security policy is easier when all computers on the network are on
the enterprise’s campus. On an enterprise’s internal network, there should be security policies in place to detect
and halt an outside attack that uses an internal machine as a staging platform. Computers at the backup site
are subject to the corporate security policy, and therefore are not high-risk computers. Computers on the
network that are at the enterprise’s remote offices, perhaps with different IS and security employees who have
different ideas about security, are more risky than choices A and B, but obviously less risky than home
computers.